We are a North American company with head office in China (China office already a different forest and domain). However, we want to extend the North American domain and Active Directory into China. The employees of China office will be using ~80% of the services
currently utilized globally. This includes all the SSO, Exchange, same O365 Tenant, etc.
There have been some concerns raised about replicating non-Chinese employee's AD data (and other regulatory considerations like GDPR) through the Great Firewall of China. The new cybersecurity laws in China allow PKI and AD traffic encryption but not without the ability for the government to have access to this information.
I am wondering what have other companies in North America and Europe done to overcome this challenge?
We chatted shortly about a stand alone forest with a trust but this may or may not be the best solution.