What is the ARRAffinitySameSite cookie?
ARRAffinitySameSite is generated automatically by Azure Application Request Routing (ARR), the load-balancing component used by Microsoft Azure App Service to distribute traffic across multiple server instances. It appears on any website or web application hosted on Azure App Service that has session affinity enabled.
The cookie is set automatically by the hosting platform, not by the website owner, on the first HTTP request to the application. It is the SameSite-attribute variant of the older ARRAffinity cookie, introduced to comply with modern browser policies on cross-site cookies.
What data it stores
The cookie stores an encrypted identifier, generated by Azure, indicating which server instance in the cluster the current session has been assigned to. The value is a hash string controlled exclusively by Azure's infrastructure, with no personally identifiable data readable by the site owner.
The information travels between the visitor's browser and the Azure servers hosting the application, solely to route subsequent requests to the same server instance.
What it is used for
The cookie's purpose is purely technical: it ensures that, for the duration of a visit, the user stays connected to the same server instance in a multi-server (load-balanced) environment. Without it, a user's successive requests could land on different instances, potentially causing lost session data, authentication errors, or inconsistent application behavior.
For the site owner, this cookie contributes to the stability and correct operation of the application hosted on Azure, and has nothing to do with traffic analysis or advertising.
Does it require consent?
ARRAffinitySameSite is classified as a strictly necessary cookie (required for the technical operation of the site), consistent with guidance from European data protection authorities on load-balancing cookies. Strictly necessary cookies do not require prior visitor consent under the ePrivacy Directive and its national implementations (in Romania, Law 506/2004).
- The site owner should still list it in the cookie policy, with its purpose and duration.
- It should not be placed in categories requiring active opt-in consent (statistics/marketing/preferences).
- If the site is hosted on Azure App Service with load balancing, verify it actually appears in a cookie scan.
How to block or delete ARRAffinitySameSite
Visitors can delete or block this cookie from their browser settings (Chrome, Firefox, Edge, Safari — per-site cookie management), but doing so may cause session errors or repeated disconnections on Azure-hosted sites with load balancing enabled, since its function is strictly technical.
Being strictly necessary, the site owner isn't required to block it pending consent, unlike statistics or marketing cookies. A CMP such as CookieFix can still classify it correctly after scanning the site, so the cookie policy stays complete and accurate without interfering with the Azure application's operation.
Frequently asked questions
It's a technical cookie set by Microsoft Azure App Service to keep a visitor connected to the same backend server in a load-balanced cluster.
No. It's a strictly necessary cookie with no personally identifiable data, used only to keep the Azure-hosted web application working correctly.
No, since it's technically necessary it doesn't require prior consent, but it should still be listed in the site's cookie policy.
You may experience session errors, disconnections, or inconsistent site behavior, since browser requests could reach different servers in the cluster.