Passkey/FIDO2 for users in mainland China – recommended approach?

Your global tenant is an important distinction: Microsoft's China restriction for Authenticator passkeys explicitly covers Azure operated by 21Vianet, which is not your deployment. Microsoft documents iOS sign-in to global organizations while in China, but that wording is not a blanket assurance for every permanently resident user's network and device. Android also depends on supported platform APIs and attestation services, including Google Play Integrity, so do not assume equivalent availability on devices without those services. Pilot physical FIDO2 keys as an alternative, checking the supported operating system, browser and application combinations. Evaluate other passkey providers against your organization's approved provider and attestation requirements. Use narrowly scoped, short-lived Temporary Access Passes for initial registration where appropriate. Test registration, recovery and everyday sign-in from the actual mainland networks before enforcing phishing-resistant Conditional Access. Retain emergency access and a documented recovery process during the transition.