Forum Discussion
Passkey/FIDO2 for users in mainland China – recommended approach?
Hi,
We are currently evaluating the adoption of Passkey/FIDO2 in Microsoft Entra ID as part of our strategy to move users away from traditional authentication methods such as SMS and voice and towards phishing-resistant authentication.
Our Microsoft Entra ID tenant is a global tenant (not Azure China operated by 21Vianet), but we have a group of users who are physically located in mainland China.
For users in other regions, we are evaluating Passkeys in Microsoft Authenticator and FIDO2 security keys. However, before defining the approach for our users in China, we would like to better understand the supported and recommended architecture for this particular scenario.
We have reviewed the Microsoft documentation and understand that:
- Passkeys are not available for Microsoft Azure operated by 21Vianet.
- On iOS, Microsoft Authenticator Passkeys can be used to sign in to global organizations while the user is in China.
- On Android, Passkey authentication has dependencies such as Google Play Services, which raises questions for devices operating in mainland China.
Our main questions are:
- For users physically located in mainland China but authenticating against a global Microsoft Entra ID tenant, what is Microsoft's recommended approach for deploying phishing-resistant authentication with Passkey/FIDO2?
- Is Microsoft Authenticator Passkey on iOS considered a fully supported option for users permanently located in mainland China, rather than only users temporarily traveling there?
- For Android users in mainland China, what is the recommended approach considering the dependency on Google Play Services? Is Passkey in Microsoft Authenticator a realistic supported option in this scenario?
- Would physical FIDO2 security keys be the preferred or more consistent alternative for users in China when mobile Passkeys cannot be reliably used?
- Are there any other Microsoft-supported Passkey providers or authentication approaches that should be considered specifically for mainland China?
- From an enrollment perspective, what would be the recommended bootstrap process for these users? For example, would Temporary Access Pass (TAP) be the recommended method to allow users to register their Passkey/FIDO2 credential before SMS/Voice is removed?
- Are there any additional regional, connectivity, mobile OS, or application compatibility considerations that should be taken into account before enforcing a phishing-resistant Authentication Strength through Conditional Access?
Our objective is not simply to enable Passkey in the tenant, but to define a supported and sustainable authentication model for users located in mainland China before starting a broader rollout.
Any experience, Microsoft guidance, or recommended architecture for this type of scenario would be greatly appreciated.
Thanks in advance.
1 Reply
Your global tenant is an important distinction: Microsoft's China restriction for Authenticator passkeys explicitly covers Azure operated by 21Vianet, which is not your deployment. Microsoft documents iOS sign-in to global organizations while in China, but that wording is not a blanket assurance for every permanently resident user's network and device. Android also depends on supported platform APIs and attestation services, including Google Play Integrity, so do not assume equivalent availability on devices without those services. Pilot physical FIDO2 keys as an alternative, checking the supported operating system, browser and application combinations. Evaluate other passkey providers against your organization's approved provider and attestation requirements. Use narrowly scoped, short-lived Temporary Access Passes for initial registration where appropriate. Test registration, recovery and everyday sign-in from the actual mainland networks before enforcing phishing-resistant Conditional Access. Retain emergency access and a documented recovery process during the transition.
