Consultation on Improving Website Accessibility and Performance in Mainland China

Use Azure Front Door Standard/Premium in front of the existing US origin as the immediate single-origin architecture, but do not treat it as mainland-China CDN delivery because the published Front Door POP list shows nearby Asian locations—not mainland China—and Azure China CDN requires separate 21Vianet onboarding and regulatory review.

Recommended baseline architecture

Mainland and global users
          |
       Azure DNS
          |
Azure Front Door Standard/Premium
  - custom domain and managed TLS
  - WAF
  - compression
  - cache static assets
  - dynamic traffic acceleration
          |
Existing US Azure origin

Configure it as follows:

1. Create an Azure Front Door Standard or Premium profile in Azure Global.
2. Add the existing US website’s publicly resolvable hostname as the origin. Front Door accepts Azure origins and any publicly accessible custom hostname.^1^
3. Add the corporate custom domain, validate it, and enable managed HTTPS.
4. Create:
   • a cached route for versioned JavaScript, CSS, images, fonts, and other static files;
   • an uncached route for personalized pages, authentication, and non-cacheable APIs.
5. Enable compression and set explicit Cache-Control headers at the origin. Front Door provides edge caching, compression, TLS termination, WAF, and acceleration over Microsoft’s backbone.^2^
6. Restrict direct origin access so requests must pass through Front Door, after validating health probes and required origin behavior.
7. Test from several mainland provinces and ISPs, measuring DNS, connection, TLS, time-to-first-byte, and each third-party request separately.

Front Door will route each user to the closest available POP; a particular POP cannot be selected or forced.^1^ Microsoft’s published POP list includes Hong Kong SAR, Japan, Korea, Singapore, and other Asian locations, but does not list a mainland-China Front Door POP.^3^ Consequently, Front Door may improve caching and the international portion of the route, but it cannot guarantee mainland performance or eliminate cross-border variability.

Azure China CDN: conditional option

Azure China CDN is the Microsoft offering intended to provide CDN coverage within China. It is part of the physically separate Azure environment operated by 21Vianet and uses Chinese CDN vendors, with Smart Route selecting a vendor by delivery region.^4^

A possible design is:

Mainland users -> Azure China CDN -> existing US origin
Other users    -> Azure Front Door -> existing US origin

This can preserve one application/content source, but the available Microsoft documentation does not establish that Azure China CDN will approve an existing US Azure website as its production origin in this exact scenario. Generic CDN configuration supports origins specified by domain name or IP address,^5^ but that does not prove Azure China CDN’s cross-border origin eligibility or onboarding approval.

Before selecting this design, obtain written confirmation from 21Vianet/Azure China support covering:

• whether the US hostname is accepted as the origin;
• whether an origin or content repository must also exist in Azure China;
• required Chinese legal entity and contract arrangements;
• ICP and public-security filing prerequisites;
• custom-domain ownership and filing validation;
• cross-border bandwidth, cache-fill behavior, and SLA;
• treatment of personal data submitted through forms or the AI integration.

Azure China generally requires a legal entity in China and is contracted and operated separately from Azure Global.^6^

ICP and data requirements

For a website operating through infrastructure in China:

• A public non-commercial site requires an ICP filing; a commercial site may require an ICP license.
• A domain without the required filing cannot be placed online, and a filed domain must resolve to a filed IP address.
• Public-security registration must also be completed within 30 days after launch.
• Real-name verification applies.^7^

If forms, analytics, authentication, or the AI tool send personal information collected in China to the US, perform a separate PRC data-localization and cross-border-transfer assessment. Depending on the data and applicable thresholds, a security assessment, standard contract, or certification may be required.^7^ Obtain current Chinese legal advice rather than treating CDN deployment as satisfying these obligations.

Third-party embeds and AI

Neither Front Door nor Azure China CDN automatically accelerates browser requests made directly to YouTube, Vimeo, LinkedIn, or an overseas AI endpoint. Those requests use the third party’s domain and delivery path, outside your CDN configuration.

For the mainland experience:

• Remove third-party embeds and scripts from the critical rendering path.
• Load them only after user interaction, with strict timeouts and a non-blocking fallback.
• Expect YouTube and standard Vimeo embeds to be unavailable or unreliable; provide locally reachable video delivery or a poster/transcript instead.^8^
• Replace LinkedIn widgets with locally hosted, licensed static content or a normal outbound link.
• Do not proxy or copy third-party media unless licensing and platform terms permit it.
• For the AI feature, provide graceful degradation and have legal/security teams assess content controls, personal information, and cross-border data transfer. CDN caching is not suitable for personalized AI requests.

Decision

• Start with Azure Front Door Standard/Premium for global security, caching, compression, and a single US origin.
• Add Azure China CDN only after 21Vianet confirms offshore-origin eligibility and onboarding requirements in writing, and the organization can complete the Chinese entity, ICP, public-security, and data-compliance work.
• If reliable mainland availability is mandatory, a purely US-hosted origin plus offshore edge delivery cannot provide the same assurance as an approved in-country delivery architecture. The requirement to maintain no China-side service at all may therefore conflict with the reliability and regulatory objective.

References

1. Azure Front Door frequently asked questions (FAQ)
2. Accelerate and secure your web application with Azure Front Door
3. Azure Front Door POP locations by metro
4. Service availability and roadmaps for Microsoft Azure operated by 21Vianet
5. Origin interface-Property Details
6. Azure in China checklist
7. Data sovereignty and China regulations
8. Does YouTube Work in China? Blocked Embeds, ICP & the Compliant Fix