How is Application insight tracking the User_Id?

Question

Im running a Azure Webapp with application insight.

I know Microsoft cant show the real IP (Client_IP) so I add the real IP address to all requests (Ip).

I have a visitor client_id="h9zbt" that in the last 24h is using 48 different client_IP adresses.

The same user also has several real IPv6 adresses.

I like to block this IP from my website, but I think this looks so strange.

Is it really the same user?

How is Application insight tracking the User_Id?

Image link

Govern

Answer 1

Usually application insights is automatically opening a session automatically for each user (look for the ai_session key). Therefore the default user scope would be a session scope.

You can override this behaviour by sending a user context if you have some kind of sign-in. (https://learn.microsoft.com/en-us/azure/application-insights/app-insights-usage-send-user-context)

I find it likely that it's the same user on the same device, just using several IP-addresses, maybe as an unsuccessful attempt to stay anonymous.

Strumpet

Thanks alot. I will track this user some time to see if its a robot. I will upvote when my rep is higher. – Govern

No worries. But If my answer or any other answer satisfies you then please choose one as accepted answer. Both parties will get some rep and it just makes it easier for others to see whether you still have unaddressed questions regarding the issue. – Strumpet

@Strumpet - Let me get this straight... so you're saying 1. User Id is set by Azure, tied to session. And 2. if we want to make it a more helpful value, we'd need to use an initializer like in your link, e.g. to set Context.User.Id = customAppUserName? – Collinsia

@Strumpet - how does this answer where User_Id comes from / how it's set / anything about it? And that linked MS doc example just shows copying 1 telemetry object's user_id to another.... how is that helpful – Collinsia

Answer 2

User IDs should persist across user sessions to track how users behave over time. There are various approaches for persisting the ID.

A definition of a user that you already have in your service.
If the service has access to a browser, it can pass the browser a cookie with an ID in it. The ID will persist for as long as the cookie

remains in the user's browser. If necessary, you can use a new ID each session, but the results about users will be limited. For example, you won't be able to see how a user's behavior changes over time.

The ID should be a Guid or another string complex enough to identify each user uniquely. For example, it could be a long random number.

If the ID contains personally identifying information about the user, it is not an appropriate value to send to Application Insights as a user ID. You can send such an ID as an authenticated user ID, but it does not fulfill the user ID requirement for usage scenarios.

mentioned in Azure doc. https://learn.microsoft.com/en-us/azure/application-insights/app-insights-usage-send-user-context

Bennington

This doesn't answer the question of "how is User_Id set?"... It's set by Azure, not by us. – Collinsia