What is the ARRAffinity cookie?
ARRAffinity is a cookie generated automatically by Azure App Service, Microsoft's cloud web hosting service. It is not set directly by the website owner but by the load-balancing infrastructure called Application Request Routing (ARR), part of the Azure platform.
It appears as soon as a visitor accesses a website or web application hosted on Azure App Service that runs behind multiple server instances. It is present on a wide range of sites and applications, from online stores to corporate portals, wherever the hosting infrastructure uses Azure.
What data it stores
The cookie's value is an encrypted string generated by Azure that identifies the backend server instance the visitor was assigned to on the first request. The exact value format varies and is internal to the Azure platform, not publicly documented in detail.
The cookie is sent to the domain of the visited website (not to a separate third-party domain) and is read by the Azure infrastructure on every subsequent request to maintain the route to the same server. A similar cookie, ARRAffinitySameSite, may appear alongside it for compatibility with modern browser same-site policies.
What it is used for
ARRAffinity's purpose is purely technical: it maintains "session affinity," meaning it ensures all requests from the same visitor, during the same browsing session, reach the same server instance behind the load balancer.
This matters for applications that keep state on the server (for example, shopping carts, multi-step forms, or login sessions) which would otherwise misbehave if requests were routed randomly to different instances. Without this cookie, a site running on multiple server instances could show inconsistent behavior to some users.
Does it require consent?
ARRAffinity is generally classified as a strictly necessary cookie, since it supports the site's core technical operation — correct request routing — and is not used for analytics or marketing purposes.
- Under the ePrivacy Directive (2002/58/EC) and GDPR guidance, strictly necessary cookies do not require prior visitor consent.
- Site owners should still list it in the cookie policy, noting the provider (Microsoft Azure), purpose (load balancing), and duration (session).
- It's worth periodically scanning the site to confirm the cookie is correctly categorized as necessary and not mixed up with analytics cookies emitted by the same cloud infrastructure.
How to block or delete ARRAffinity
A visitor can delete or block ARRAffinity through browser settings (for example, clearing cookies for a specific site or using private/incognito browsing). Blocking it may cause session errors or loss of entered data (shopping cart, form fields) on sites that depend on Azure's load balancing.
Since it's a strictly necessary cookie, site owners are not required to block it pending consent — but should make sure their consent management platform (CMP) doesn't misclassify it as optional. A CMP like CookieFix can help by automatically blocking scripts from categories that actually require visitor consent, while letting strictly necessary cookies like ARRAffinity keep the site running normally.
Frequently asked questions
No, it's a technical cookie used by Microsoft Azure to route requests to the correct server (load balancing), and it does not track visitor behavior for marketing or analytics purposes.
No, since it's classified as a strictly necessary cookie, it does not require prior visitor consent under the ePrivacy Directive, but it should still be listed in the site's cookie policy.
You may experience session errors, or lose form data or shopping cart contents on sites hosted on Azure App Service that run on multiple server instances.
It's typically a session cookie, meaning it's deleted automatically when the browser closes, though behavior can vary depending on the application's configuration.