Forum Discussion
Passkey/FIDO2 for users in mainland China – recommended approach?
Your global tenant is an important distinction: Microsoft's China restriction for Authenticator passkeys explicitly covers Azure operated by 21Vianet, which is not your deployment. Microsoft documents iOS sign-in to global organizations while in China, but that wording is not a blanket assurance for every permanently resident user's network and device. Android also depends on supported platform APIs and attestation services, including Google Play Integrity, so do not assume equivalent availability on devices without those services. Pilot physical FIDO2 keys as an alternative, checking the supported operating system, browser and application combinations. Evaluate other passkey providers against your organization's approved provider and attestation requirements. Use narrowly scoped, short-lived Temporary Access Passes for initial registration where appropriate. Test registration, recovery and everyday sign-in from the actual mainland networks before enforcing phishing-resistant Conditional Access. Retain emergency access and a documented recovery process during the transition.
Thanks Jamony, this is very helpful.
One point I would like to clarify further is the practical approach for users who are permanently located in mainland China.
If the goal is to move these users away from SMS and voice authentication, would you consider the following as the main options to evaluate?
- Microsoft Authenticator Passkey for iOS users.
- Physical FIDO2 security keys as an alternative where mobile Passkeys are not reliable.
- For Android users without reliable access to Google Play Services, would a physical FIDO2 key currently be the more practical supported option?
- TAP as the bootstrap method for initial registration.
Also, do you know of any Microsoft documentation specifically covering Passkey deployment for users permanently located in mainland China, rather than users temporarily traveling there?
Thanks again for your guidance.
Hi schiachris, and thanks Jamony for the earlier reply. I agree with piloting first, and here's how I'd approach it.
I checked Microsoft's "Download Microsoft Authenticator in China" page. It marks passkeys as unavailable on both iOS and Android in China. A note on the same page says passkeys aren't available for Azure operated by 21Vianet, so it's unclear whether the limit applies to your global tenant. I couldn't find any Microsoft documentation for users who live in mainland China, so I'd treat Authenticator passkeys as unconfirmed until you test them.
What I'd do in your shoes:
1. Pilot both Authenticator passkeys and physical FIDO2 keys approved for use in China, across iOS, Android, and managed Windows. Check sourcing and import rules with your compliance team.
2. Use a short-lived, single-use Temporary Access Pass for the initial registration, scoped to the pilot group, and have each user register two methods.
3. Test registration and daily sign-in from real mainland networks. Run a report-only phishing-resistant authentication strength policy before you enforce anything.
4. Keep Authenticator one-time codes as a fallback for now. Microsoft-provided SMS and voice retire on February 1, 2027, and users with no other method will get a blocking passkey prompt.
I'd also reach out to your Microsoft account team. They know your tenant, and they can check with their Microsoft China counterparts on what's supported for your users.
Hope that helps, and I'd be curious how the pilot goes.
Thanks for the detailed information, really helpful.
I’m continuing to review the different scenarios for this specific use case, especially around users permanently located in mainland China and the available options once SMS and voice are retired.
I’ll keep validating the alternatives and the related Microsoft documentation before defining the approach.
Thanks again for sharing your experience and recommendations.
