Does Visual Studio App Center Work in China? Data Residency, PIPL & a Retiring Service
Visual Studio App Center stores all data in the United States with no other-region option, so telemetry from your mainland app users is a cross-border transfer under PIPL — and Microsoft has retired the service. A compliance-first look at the data-residency and continuity risks.
Does Visual Studio App Center work in China?
Not safely — and, increasingly, not at all. App Center stores every byte in the United States with no option for another region, so each crash log, device identifier and analytics event from your mainland users is a cross-border transfer of personal information under PIPL — and Microsoft has already retired the service.
Microsoft states plainly that "App Center operates almost entirely in the United States," that "all data and processing … occurs in the United States," and that "there's no option available for hosting this customer data in any other country/region." It runs as a "first-party Microsoft Azure service," and Microsoft's own note warns that "for some users in China region, Analytics and Diagnostics SDK data may experience significant delay or not make it to" its US servers. Telemetry collected from mainland app users is personal information, so sending it offshore is a cross-border transfer PIPL governs — notice, separate consent and a transfer mechanism — with no in-country storage to fall back on. On top of that, Microsoft set App Center's retirement for March 31, 2025. The table below is Microsoft's own wording and the rule each line triggers.
This is a risk map, not a verdict — your exposure turns on what your app collects, how much, and who your users are. Our China team can map your exposure with you →
What Visual Studio App Center's own documentation says about China
| Fact | Primary source |
|---|---|
| App Center keeps all your data in the United States — with no other-region option. In Microsoft's own words, "App Center operates almost entirely in the United States," and "all data and processing for Apps, Users, Organizations, Build, Distribution, Analytics and Diagnostics occurs in the United States. There's no option available for hosting this customer data in any other country/region." It runs as a "first-party Microsoft Azure service," encrypting data at rest on "Azure Storage," "Azure SQL," and "Azure Cosmos DB." No mainland-China region exists to keep your users' data in-country. | Microsoft — Visual Studio App Center Security and Compliance (learn.microsoft.com), retrieved 2026-10-07 |
| Your China app users' telemetry crosses the border by design. App Center's SDK collects device identifiers, crash logs and analytics events from your end-users — personal information — and stores it on Microsoft's "servers based in the United States." Moving that data out of the mainland is a cross-border transfer under PIPL: the handler (you, not Microsoft) must give notice, obtain separate consent, and clear a transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). For a CIIO or large-volume handler, that data must be stored in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an all-US service cannot do. | Microsoft — App Center Security & Compliance (learn.microsoft.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Microsoft itself flags that China-region data may never arrive. On the same page Microsoft warns: "Due to country specific policies and laws, we cannot guarantee that App Center works in all countries/regions. For some users in China region, Analytics and Diagnostics SDK data may experience significant delay or not make it to our servers based in the United States." So even the delivery half is unreliable from the mainland — but the issue that decides whether you may use it is where the data is allowed to live, not how fast it travels. | Microsoft — App Center Security & Compliance (learn.microsoft.com), retrieved 2026-10-07 |
| App Center is being retired — continuity is part of the risk. Microsoft's notice reads: "Visual Studio App Center is scheduled for retirement on March 31, 2025. After that date, it will not be possible to sign in with your user account nor make API calls." Only the Analytics & Diagnostics feature was kept past that date, and Microsoft has since extended it just "until the end of March 2027," steering customers to Azure Monitor and other Azure services. A China compliance posture built on a product its own vendor is sunsetting carries a continuity exposure on top of the data one. | Microsoft — Visual Studio App Center Retirement (learn.microsoft.com/appcenter/retirement), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team shipping a mobile app into mainland China, the deciding question about Visual Studio App Center is not how fast its dashboards paint — it is where the data your app collects is allowed to live, and whether the service will still be running next year. Microsoft answers both in its own documentation, and for a China audience neither answer is comfortable: App Center keeps all of its data in the United States with no option for any other region, and Microsoft has already retired the product. The telemetry your SDK sends home — device identifiers, crash reports, analytics events — is personal information, so routing it to servers in the US is a cross-border transfer China’s law governs; and standing a China presence on a service Microsoft is sunsetting layers a continuity risk on top of the legal one.
Visual Studio App Center in China at a glance
| What decides it | In App Center's own terms |
|---|---|
| Where it runs | A “first-party Microsoft Azure service.” All data and processing “occurs in the United States,” and there's “no option available for hosting this customer data in any other country/region.” No mainland-China region exists. |
| Your China users' data | Device identifiers, crash logs and analytics events from mainland app users are stored on “servers based in the United States” — a cross-border transfer of personal information under PIPL, with no in-country storage option. |
| Reachable from China? | Microsoft “cannot guarantee that App Center works in all countries/regions,” and warns that for “users in China region,” SDK data “may experience significant delay or not make it to” its US servers. |
| ICP filing | ICP filing governs public sites hosted inside mainland China. App Center is a backend build, distribute and telemetry service, not a hosted site — so ICP is a question for your app's own public presence, not App Center. |
| Continuity | Microsoft “scheduled [App Center] for retirement on March 31, 2025.” Only Analytics & Diagnostics remains, extended “until the end of March 2027,” with customers steered to Azure Monitor. |
All of App Center’s data lives in the United States
Microsoft is unusually direct about where App Center runs. On its Security and Compliance page it states that “App Center operates almost entirely in the United States,” that “all data and processing for Apps, Users, Organizations, Build, Distribution, Analytics and Diagnostics occurs in the United States,” and that “there’s no option available for hosting this customer data in any other country/region.” App Center is, in Microsoft’s words, a “first-party Microsoft Azure service,” encrypting data at rest with the features of “Azure Storage,” “Azure SQL,” and “Azure Cosmos DB” — all outside the mainland. It is also multi-tenant: “all customer data is held within one set of data stores,” with “no option to hold a customer’s data in a separate or isolated set.” For a China audience that settles the residency question before performance is ever in play — there is no mainland-China region to anchor to, and no control that keeps your users’ data in-country.
Your China users’ telemetry is a cross-border transfer
What App Center collects is not anonymous counters. Its SDK gathers device identifiers, crash logs and analytics events from the people using your app — personal information under China’s law. Because every one of those records lands on Microsoft’s “servers based in the United States,” sending it there is a cross-border transfer of personal information under PIPL: as the handler — you, not Microsoft — you must give notice, obtain separate consent, and clear one transfer mechanism, whether a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or move personal information above the regulatory volume thresholds, that data has to be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty an all-US service cannot meet. Microsoft even flags the delivery half itself: it “cannot guarantee that App Center works in all countries/regions,” and warns that “for some users in China region, Analytics and Diagnostics SDK data may experience significant delay or not make it to” its US servers. Either way, the fact that decides whether you may use it is not latency — it is where the data is allowed to sit.
A moving target — Microsoft has retired App Center
Continuity is the second half of the compliance question, and here it is already decided. Microsoft’s own retirement notice reads: “Visual Studio App Center is scheduled for retirement on March 31, 2025. After that date, it will not be possible to sign in with your user account nor make API calls.” Only the Analytics & Diagnostics feature was kept running past that date, and Microsoft has since extended it just “until the end of March 2027,” while steering customers onto Azure Monitor, Azure Pipelines and third-party services. Building — or maintaining — a China data posture on a product its own vendor is winding down means the compliance work you do today has a short shelf life. A lawful mainland presence needs infrastructure that will still be standing, and still be filed, after App Center is gone.
This is a risk map, not a verdict: what you must do turns on what your app collects, how much personal data you hold, and who your users are — worth settling with counsel before you ship.
Where 21YunBox fits — a compliant overlay, not a migration
You keep your app and your existing stack exactly as they are. We add the piece an all-US, now-retiring service cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of the endpoints your app already talks to, so data from your Chinese users can be received and handled in-country — no rebuild, no second codebase, and no scramble to re-platform the week App Center shuts off. Our China team maps your PIPL cross-border and data-residency obligations against your entity, your data volumes and your users, then stands up the in-country delivery and storage a lawful China presence requires — on a footing that outlasts the tool you are migrating off.
Related reading:
