Does Azure Front Door Work in China? Global Edge, ICP & the 21Vianet Instance
Global Azure Front Door serves mainland China from a worldwide edge with no PoP inside the mainland, so a China-facing site is delivered cross-border with no ICP footing. Since September 2025, Front Door Standard and Premium have also run in-country, inside the separate 21Vianet-operated Azure China cloud, with its own account, entity and ICP requirement. A compliance-first look at the two doors.
Does Azure Front Door work in China?
Not the Azure Front Door you already run. Your global profile serves mainland China from a worldwide edge with no point of presence inside the mainland, so it gives a China-facing site no ICP footing and sends Chinese users' data offshore. Front Door Standard and Premium do run in-country — generally available since September 2025 — but only inside the separate, 21Vianet-operated Azure China cloud, which your global profile never reaches.
Microsoft calls Front Door “an advanced content delivery network (CDN) for the cloud” built on “Microsoft's extensive global edge network,” and its global documentation lists the Standard, Premium and Classic tiers as “available in Microsoft Azure (Commercial) and Microsoft Azure Government (US).” The in-China Front Door is documented separately, on docs.azure.cn, where Microsoft names it “the recommended replacement service” for the retired Azure China CDN. It lives in “Microsoft Azure operated by 21Vianet” — “a physically separated instance of cloud services located in China” — and is reached through a Chinese legal entity, a separate azure.cn account and, before any custom domain goes live, ICP registration. Keep serving the mainland from the global profile instead and your users' data rides offshore edge PoPs — a cross-border transfer PIPL governs, on infrastructure that cannot be ICP-filed. The table below pairs Microsoft's own wording with the rule each door triggers.
This is a risk map, not a verdict — which door fits turns on your entity, your data and who your users are. Our China team can map the global-vs-21Vianet choice and your exposure with you →
What Azure Front Door's own documentation says about China
| Fact | Primary source |
|---|---|
| Global Azure Front Door is a worldwide edge CDN with no point of presence in mainland China. Microsoft calls it “an advanced content delivery network (CDN) for the cloud” that, “by using Microsoft's extensive global edge network … provides efficient content delivery through global and local points of presence (PoPs),” spanning “more than 118 edge locations across 100 metro areas.” Microsoft's own list of Front Door PoP metros names no city in mainland China. | Microsoft Learn — Azure Front Door overview (front-door-overview) and Azure Front Door POP locations by metro (edge-locations-by-region), retrieved 2026-10-19 |
Microsoft's global documentation covers Azure Commercial and US Government; the China cloud is documented separately. Under “Where is the service available?”, the global overview states: “Azure Front Door Standard, Premium, and Classic tiers are available in Microsoft Azure (Commercial) and Microsoft Azure Government (US).” Front Door for the mainland has its own documentation on docs.azure.cn and its own portal, so a profile in your global subscription has no footing inside the mainland. | Microsoft Learn — Azure Front Door overview (front-door-overview), retrieved 2026-10-19 |
Front Door Standard and Premium run inside China — in the separate 21Vianet cloud. Microsoft announced in September 2025 that “Azure Front Door Standard and Premium are now generally available in the Azure China regions,” and when Azure China CDN was retired “starting from December 1, 2025,” it named “Azure Front Door (AFD)” “the recommended replacement service,” adding that “Azure Front Door is available in China East 2 and China North 3 regions.” Azure in China is “a physically separated instance of cloud services located in China,” “independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (‘21Vianet’)” — reached through its own azure.cn account and portal, not your global subscription. | Azure Updates — ID 501200, generally available September 2025; docs.azure.cn — Azure CDN retirement in China FAQ; Microsoft Learn — Microsoft Azure in China (overview-operations); retrieved 2026-10-19 |
| Serving a public mainland site needs an ICP filing — and the in-China Front Door won't take a custom domain without one. Microsoft's own China checklist lists, among the PRC-law obligations customers must meet, an “ICP filing for public non-commercial website,” an “ICP license for commercial website,” and “public security registration for public website” — the ICP regime under State Council Order No. 292 and MIIT Order No. 33. On the 21Vianet cloud, Front Door's custom-domain guide states: “Custom domain creation is not allowed without ICP registration.” A global profile, by contrast, has nothing in the mainland to file against. How ICP filing works → | Microsoft Learn — Azure in China checklist (overview-checklist); docs.azure.cn — Add a custom domain to Azure Front Door; retrieved 2026-10-19; State Council Order No. 292; MIIT Order No. 33 |
| On the global profile, your China users' data stays offshore. Routing mainland visitors through offshore PoPs is a cross-border transfer under PIPL — notice, separate consent and one transfer mechanism (Articles 38–43). Microsoft's China checklist adds that the “China Cybersecurity Law states that PII and important data of CII operator must be stored domestically” (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — a residency duty offshore edge cannot meet. | Microsoft Learn — Azure in China checklist (overview-checklist), retrieved 2026-10-19; PIPL Articles 38–43 and 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-19.
Whether Azure Front Door “works” in mainland China is a licensing-and-data question before it is a performance one. Global Front Door is Microsoft’s worldwide edge CDN, and the edge is exactly the catch: its points of presence span the world but stop outside the mainland, so a China-facing site fronted only by global Front Door is reached across the border and still needs an ICP filing to serve the public lawfully. Front Door does run inside China — its Standard and Premium tiers have been generally available there since September 2025 — but not as part of the global subscription most teams already hold. It runs there inside “Microsoft Azure operated by 21Vianet,” a wholly separate cloud with its own account, portal and filing path. Those are the two doors, and Microsoft documents both in its own words.
Azure Front Door in China at a glance
| What decides it | In Microsoft's own terms |
|---|---|
| What it is | Microsoft calls Front Door “an advanced content delivery network (CDN) for the cloud,” built on “Microsoft's extensive global edge network” across “more than 118 edge locations” in “100 metro areas.” The global service is a worldwide edge, positioned close to users — not an in-China one. |
| Where global Front Door runs | Microsoft's global documentation lists the Standard, Premium and Classic tiers as “available in Microsoft Azure (Commercial) and Microsoft Azure Government (US),” and none of the cities on its Front Door PoP list is in mainland China. A global profile reaches the mainland only from outside it. |
| Front Door inside China | Since September 2025, the Standard and Premium tiers have been generally available in “Microsoft Azure operated by 21Vianet” — “a physically separated instance of cloud services located in China” — documented on its own docs.azure.cn, where Microsoft names Front Door “the recommended replacement service” for the retired Azure China CDN. |
| Entity & account | Microsoft's China checklist sets customer eligibility at a “Legal entity in China,” and the service runs from a separate azure.cn account and portal.azure.cn, apart from your global azure.microsoft.com subscription. "We already run Front Door" does not carry across. |
| Serving the public | Microsoft's China checklist lists an “ICP filing for public non-commercial website,” an “ICP license for commercial website,” and “public security registration for public website.” On the 21Vianet cloud, Front Door checks the filing itself and will not create a custom domain without ICP registration. |
| Your data on global Front Door | Personal information of mainland users routed through offshore PoPs stays outside China — a cross-border transfer PIPL governs, on edge infrastructure that cannot be ICP-filed. |
Door one — global Front Door is a worldwide edge that stops outside the mainland
Front Door is built to be everywhere your users are. Microsoft describes it as “an advanced content delivery network (CDN) for the cloud” that, “by using Microsoft’s extensive global edge network … provides efficient content delivery through global and local points of presence (PoPs),” drawing on “more than 118 edge locations across 100 metro areas.” Under “Where is the service available?” Microsoft’s global documentation names the clouds that edge serves: the “Standard, Premium, and Classic tiers are available in Microsoft Azure (Commercial) and Microsoft Azure Government (US).” The China cloud carries its own Front Door, documented separately (door two below), and Microsoft’s list of Front Door PoP metros names no city in mainland China — so the profile in your global subscription reaches the mainland only from outside it.
So the geography settles the licensing question before performance ever enters it. A public-facing website delivered to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. A global Front Door profile has none — its edge is everywhere except there — so there is simply nothing on it to file against. Reaching China through an offshore edge is not the same as being cleared to operate inside it, and tuning the edge does not create the mainland footing a filing needs.
Door two — Azure Front Door does run in China, as the separate 21Vianet cloud
Front Door is not absent from the mainland — it simply is not part of your global subscription when it runs there. In September 2025 Microsoft announced that “Azure Front Door Standard and Premium are now generally available in the Azure China regions,” inside what it calls “a physically separated instance of cloud services located in China,” one “independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (‘21Vianet’), a wholly owned subsidiary of Beijing 21Vianet Broadband Data Center Co., Ltd.” The operator is 21Vianet, not Microsoft; the service has its own portal and documentation at portal.azure.cn and docs.azure.cn, apart from the global azure.microsoft.com. When Azure China CDN was retired “starting from December 1, 2025,” Microsoft named “Azure Front Door (AFD)” as “the recommended replacement service,” and its own side-by-side comparison puts the in-country footprint at “2 PoPs in Azure China North 3 region and Azure China East 2 region.”
Getting through that door is a separate exercise, not a toggle on the account you hold. Microsoft’s China checklist sets customer eligibility at a “Legal entity in China” and lists, as obligations customers must meet under PRC law, an “ICP filing for public non-commercial website,” an “ICP license for commercial website,” and “public security registration for public website.” Front Door on the 21Vianet cloud builds the filing into setup: “Custom domain creation is not allowed without ICP registration.” So the in-country path is a Chinese legal entity, a separate 21Vianet account, and an ICP filing tied to that mainland cloud — a real mainland option, though not automatic compliance, and not one your existing Front Door profile reaches.
Your China users’ data on global Front Door stays offshore
Keep serving the mainland from your global Front Door instead, and your users’ personal information rides the nearest offshore PoP — outside China. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Microsoft — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). Microsoft’s checklist names the residency duty in the same breath, noting the “China Cybersecurity Law states that PII and important data of CII operator must be stored domestically” (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — which an offshore edge cannot do, and an offshore endpoint cannot be ICP-filed. The 21Vianet door brings delivery in-country, but it does not settle the data question on its own: if that profile still fronts an origin outside the mainland, the personal information it forwards there is a cross-border transfer as well.
This is a risk map, not a verdict: which door fits — global, the 21Vianet instance, or a compliant layer in front of your origin — turns on your entity, your data and who your users are, and it is worth confirming with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Azure Front Door — global, or the 21Vianet instance. We add the piece the global edge leaves you to arrange yourself: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing origin — no rebuild, no second codebase, and no forced move between clouds. Our China team maps which door fits, assesses your PIPL cross-border and data-residency exposure for your entity and data volumes, and stands up the in-country delivery and storage a compliant China presence requires, while your application stays exactly where it already runs.
Related reading:
