Forum Discussion
Passkey/FIDO2 for users in mainland China – recommended approach?
Hi,
We are currently evaluating the adoption of Passkey/FIDO2 in Microsoft Entra ID as part of our strategy to move users away from traditional authentication methods such as SMS and voice and towards phishing-resistant authentication.
Our Microsoft Entra ID tenant is a global tenant (not Azure China operated by 21Vianet), but we have a group of users who are physically located in mainland China.
For users in other regions, we are evaluating Passkeys in Microsoft Authenticator and FIDO2 security keys. However, before defining the approach for our users in China, we would like to better understand the supported and recommended architecture for this particular scenario.
We have reviewed the Microsoft documentation and understand that:
- Passkeys are not available for Microsoft Azure operated by 21Vianet.
- On iOS, Microsoft Authenticator Passkeys can be used to sign in to global organizations while the user is in China.
- On Android, Passkey authentication has dependencies such as Google Play Services, which raises questions for devices operating in mainland China.
Our main questions are:
- For users physically located in mainland China but authenticating against a global Microsoft Entra ID tenant, what is Microsoft's recommended approach for deploying phishing-resistant authentication with Passkey/FIDO2?
- Is Microsoft Authenticator Passkey on iOS considered a fully supported option for users permanently located in mainland China, rather than only users temporarily traveling there?
- For Android users in mainland China, what is the recommended approach considering the dependency on Google Play Services? Is Passkey in Microsoft Authenticator a realistic supported option in this scenario?
- Would physical FIDO2 security keys be the preferred or more consistent alternative for users in China when mobile Passkeys cannot be reliably used?
- Are there any other Microsoft-supported Passkey providers or authentication approaches that should be considered specifically for mainland China?
- From an enrollment perspective, what would be the recommended bootstrap process for these users? For example, would Temporary Access Pass (TAP) be the recommended method to allow users to register their Passkey/FIDO2 credential before SMS/Voice is removed?
- Are there any additional regional, connectivity, mobile OS, or application compatibility considerations that should be taken into account before enforcing a phishing-resistant Authentication Strength through Conditional Access?
Our objective is not simply to enable Passkey in the tenant, but to define a supported and sustainable authentication model for users located in mainland China before starting a broader rollout.
Any experience, Microsoft guidance, or recommended architecture for this type of scenario would be greatly appreciated.
Thanks in advance.
4 Replies
Your global tenant is an important distinction: Microsoft's China restriction for Authenticator passkeys explicitly covers Azure operated by 21Vianet, which is not your deployment. Microsoft documents iOS sign-in to global organizations while in China, but that wording is not a blanket assurance for every permanently resident user's network and device. Android also depends on supported platform APIs and attestation services, including Google Play Integrity, so do not assume equivalent availability on devices without those services. Pilot physical FIDO2 keys as an alternative, checking the supported operating system, browser and application combinations. Evaluate other passkey providers against your organization's approved provider and attestation requirements. Use narrowly scoped, short-lived Temporary Access Passes for initial registration where appropriate. Test registration, recovery and everyday sign-in from the actual mainland networks before enforcing phishing-resistant Conditional Access. Retain emergency access and a documented recovery process during the transition.
Thanks Jamony, this is very helpful.
One point I would like to clarify further is the practical approach for users who are permanently located in mainland China.
If the goal is to move these users away from SMS and voice authentication, would you consider the following as the main options to evaluate?
- Microsoft Authenticator Passkey for iOS users.
- Physical FIDO2 security keys as an alternative where mobile Passkeys are not reliable.
- For Android users without reliable access to Google Play Services, would a physical FIDO2 key currently be the more practical supported option?
- TAP as the bootstrap method for initial registration.
Also, do you know of any Microsoft documentation specifically covering Passkey deployment for users permanently located in mainland China, rather than users temporarily traveling there?
Thanks again for your guidance.
Hi schiachris, and thanks Jamony for the earlier reply. I agree with piloting first, and here's how I'd approach it.
I checked Microsoft's "Download Microsoft Authenticator in China" page. It marks passkeys as unavailable on both iOS and Android in China. A note on the same page says passkeys aren't available for Azure operated by 21Vianet, so it's unclear whether the limit applies to your global tenant. I couldn't find any Microsoft documentation for users who live in mainland China, so I'd treat Authenticator passkeys as unconfirmed until you test them.
What I'd do in your shoes:
1. Pilot both Authenticator passkeys and physical FIDO2 keys approved for use in China, across iOS, Android, and managed Windows. Check sourcing and import rules with your compliance team.
2. Use a short-lived, single-use Temporary Access Pass for the initial registration, scoped to the pilot group, and have each user register two methods.
3. Test registration and daily sign-in from real mainland networks. Run a report-only phishing-resistant authentication strength policy before you enforce anything.
4. Keep Authenticator one-time codes as a fallback for now. Microsoft-provided SMS and voice retire on February 1, 2027, and users with no other method will get a blocking passkey prompt.
I'd also reach out to your Microsoft account team. They know your tenant, and they can check with their Microsoft China counterparts on what's supported for your users.
Hope that helps, and I'd be curious how the pilot goes.
