Does Azure Cosmos DB Work in China? Data Residency, PIPL & the 21Vianet Partition
On a global Azure account, Azure Cosmos DB runs no region inside mainland China — it stores your database in the Azure region you choose, all offshore — so your Chinese users' personal data is a PIPL cross-border transfer, and "Azure China" is a separate 21Vianet-operated cloud, not a region toggle. A compliance-first look at where your data lives.
Does Azure Cosmos DB work in China?
Reachable is not the question. Azure Cosmos DB is where your application's data lives, and on a normal global Azure account there is no mainland-China region to keep it in — so your Chinese users' personal information sits offshore, a cross-border transfer under PIPL. And "use Azure China" is not a region toggle: that is a separate cloud, run by a different company, under its own account and a Chinese entity.
Microsoft's own documentation calls Cosmos DB "a globally distributed database system" that "transparently replicates the data to all the regions associated with your Azure Cosmos DB account," configurable "in any of the Azure regions." It also lists "five distinct Azure cloud environments," where the "Azure public" cloud is "available globally" and "Microsoft Azure operated by 21Vianet" is a separate one — and Microsoft states the global and China regions "are physically disconnected." So on a global account your data stays outside the mainland: a cross-border transfer of personal information PIPL governs, with a data-localization duty attached for some handlers. The database carries no ICP filing of its own — that door sits on the public app in front of it. The table below is Microsoft's own wording and the rule each point triggers.
This is a risk map, not a verdict — which door applies turns on your entity, your data volumes and whose data you hold. Our China team can map your exposure with you →
What Azure Cosmos DB's own documentation says about China
| Fact | Primary source |
|---|---|
| Cosmos DB is a globally distributed store, and it keeps your data in the regions tied to your account. Microsoft calls it "a globally distributed database system" that "transparently replicates the data to all the regions associated with your Azure Cosmos DB account," configurable "in any of the Azure regions." Because the database holds your application's real records — your Chinese users' personal information among them — those regions are where that personal data physically sits. On a normal global Azure account, every one of them is outside mainland China. | Microsoft Learn — Distribute data globally with Azure Cosmos DB, retrieved 2026-10-07 |
| Cosmos DB's own docs treat China as a separate cloud, not a region you switch on. The same page says Cosmos DB "is available in all five distinct Azure cloud environments," listing the "Azure public" cloud ("available globally") and, separately, "Microsoft Azure operated by 21Vianet … available through a unique partnership between Microsoft and 21Vianet, one of the largest internet providers in China." China is a different environment from your global account — not a region inside it. | Microsoft Learn — Distribute data globally with Azure Cosmos DB, retrieved 2026-10-07 |
| "Azure China" means a different operator, a separate account and a Chinese entity. Microsoft describes Azure operated by 21Vianet as "a physically separated instance of cloud services located in China," "independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. ("21Vianet")" — and to use it, in its own words, "You sign OSPA with 21Vianet," not Microsoft. Microsoft also states that "Azure global regions and Azure in China regions are physically disconnected." Moving Cosmos DB in-country is a separate cloud under a separate contract, not a setting on your existing account. | Microsoft Learn — Microsoft Azure in China (overview-operations) & Azure in China FAQ, retrieved 2026-10-07 |
| The database carries no ICP filing — that door belongs to the app, while Cosmos DB's question is data residency. An ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to a public-facing internet information service, and a database serves no public site, so the obligation sits on the application in front of Cosmos DB. What the database does carry is residency: your China users' personal data held offshore is a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), and for a CIIO or large-volume handler it must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which a global Azure region cannot do. | Microsoft Learn — Azure Cosmos DB documentation, retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the real question about Azure Cosmos DB is not how quickly it answers a query — it is where the data inside it is permitted to live. Cosmos DB is Microsoft’s globally distributed NoSQL database, which means it holds your application’s own records, the personal information of your Chinese users among them. Microsoft answers the residency question in its own documentation: Cosmos DB replicates to the regions attached to your account, and on a normal global Azure account not one of those regions is inside the mainland. The endpoint responds; the exposure is that the personal data it stores sits offshore — and that “just move it to Azure China” turns out to mean a different cloud entirely, not a region you can flip on.
Azure Cosmos DB in China at a glance
| What decides it | In Microsoft's own terms |
|---|---|
| Where your data lives | A globally distributed database that “transparently replicates the data to all the regions associated with your Azure Cosmos DB account,” configurable “in any of the Azure regions.” The database is the store itself, so those regions are where your users' records sit — and on a global Azure account none is inside mainland China. |
| The China partition | Cosmos DB “is available in all five distinct Azure cloud environments”; the “Azure public” cloud is “available globally,” and “Microsoft Azure operated by 21Vianet” is a separate one — “a physically separated instance of cloud services located in China,” “physically disconnected” from global Azure. |
| Your China users' data | Held in the offshore region you chose, your Chinese users' personal information is a cross-border transfer PIPL governs (Articles 38–43) — kept out of the country it was collected in. |
| Data localization | A CIIO or large-volume handler must keep China-collected personal data in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). A global Azure account has no in-China region to meet that. |
| ICP filing | Not the database's door. Cosmos DB serves no public site, so the ICP filing (State Council Order No. 292; MIIT Order No. 33) a mainland audience needs sits on the application in front of it, not on Cosmos DB. |
No mainland region on global Azure — so your data stays offshore
Azure Cosmos DB runs your database in the Azure regions you attach to your account. In Microsoft’s own words it is “a globally distributed database system” that “transparently replicates the data to all the regions associated with your Azure Cosmos DB account,” and you can place it “in any of the Azure regions.” That is the whole residency story in one line: the database is not a cache or an edge sitting in front of your data — it is your data, and on a normal global Azure account every region it can replicate to is outside the mainland. Choose any of them for a China-facing app and your users’ records are bound to a place China’s law treats as foreign soil.
”Use Azure China” is a separate cloud, not a region toggle
The obvious reply — then host Cosmos DB in a China region — is not the small change it sounds like, and it is the part teams most often get wrong. Cosmos DB’s own documentation counts “five distinct Azure cloud environments,” and it lists “Microsoft Azure operated by 21Vianet” as one of them, apart from the “Azure public” cloud that is “available globally.” Microsoft describes that China cloud as “a physically separated instance of cloud services located in China,” one “independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (“21Vianet”),” and it states plainly that “Azure global regions and Azure in China regions are physically disconnected.” Using it is therefore not a drop-down on your existing subscription: it is a separate account in a separate cloud, contracted with 21Vianet rather than Microsoft — “You sign OSPA with 21Vianet” — and it requires a Chinese legal entity and its own ICP and compliance footing. “We already run on Azure” does not carry across that line.
Your China users’ data is a cross-border transfer
Because Cosmos DB holds personal information collected from people in China, keeping it in an offshore Azure region is, under China’s Personal Information Protection Law, a cross-border transfer. The handler — you, not Microsoft — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). And if you are a critical information infrastructure operator, or you process personal information above the regulators’ volume thresholds, that data must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty that a global Azure region, by Microsoft’s own account, has no way to meet.
ICP isn’t the database’s door — and saying so plainly matters
It would be easy to staple an ICP warning onto every China page, but it does not belong on Cosmos DB. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to a public-facing website and the mainland hosting that serves it — and a database serves no public site of its own. So that obligation sits on the application in front of your Cosmos DB, if that application faces a Chinese audience, not on the database layer. Cosmos DB’s compliance weight is narrower and concentrated in one place: data residency. Keeping the two doors distinct is the point — it tells you exactly which risk lives where, instead of blurring a storage question into a licensing one.
This is a risk map, not a verdict: whether a localization duty applies, which cross-border mechanism fits, and whether you ever need the 21Vianet cloud at all depend on your entity, how much personal data you hold, and whose it is — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Cosmos DB as your database, exactly where it already runs. What we add is the layer it was never meant to provide on its own: compliant, ICP-filed delivery from inside the mainland for the application in front of it, together with any in-China storage your data-residency obligations require — arranged around your existing stack, with no rebuild, no second codebase, and no move off Azure. Our China team maps your PIPL cross-border and data-localization exposure against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your database stays put.
Related reading:
