Application Insights geolocation doesn't match MaxMind/Cloudflare

Question

I'm setting up a new web site hosted in Azure and proxied through Cloudflare. I've noticed that Application Insights and Cloudflare are reporting different geolocations for incoming requests. My personal IP address is identified as being in England by App Insights and the US by Cloudflare (Cloudflare is correct). My phone was identified as Sweden by App Insights (again, I'm in the US).

I have disabled IP masking in App Insights and verified that the correct IP address is being logged in the client_ip field.

According to their own documentation Cloudflare uses the MaxMind GeoIP database (source). I haven't found an authoritative answer on what App Insights uses, but I have seen some claims that it also uses MaxMind. I used the MaxMind demo tool to test my own IP address and confirmed that it returns accurate information.

As an experiment, I used a Telemetry Initializer to manually override the recorded IP address to 8.8.8.8 (one of Google's DNS servers). MaxMind shows its location as "Los Angeles, California, United States, North America". App Insights shows "Glenmont, Ohio, United States".

Can anyone explain this discrepancy?

Telemetry initializer:

public class IpAddressTelemetryInitializer : ITelemetryInitializer
{
    public void Initialize(ITelemetry telemetry)
    {
        telemetry.Context.Location.Ip = "8.8.8.8";
    }
}

MaxMind results:

Application Insights results:

Answer 1

Azure Monitor uses MaxMind GeoLite2 for IP address lookup (see Azure Monitor FAQ). GeoLite2 is a free version of MaxMind databases and web services so its results can be less accurate than GeoIP2 database. This could be one of the reasons for discrepancies you are seeing.

Another potential reason is the way how proxy IP addresses are handled by Cloudflare and Azure. Application Insights module collects the client IP address unless the header X-Forwarded-For is set. If there is more than one IP address in the header, the last IP address is used to populate geolocation fields.

Cloudflare uses the header X-Forwarded-For to maintain proxy server and original visitor IP addresses. If there was no existing X-Forwarded-For header in the request sent to Cloudflare, X-Forwarded-For will contain the client IP. Otherwise, Cloudflare appends the IP address of the HTTP proxy to the header and the proxy IP address will be the last in the list. So it is possible that Azure gets a proxy IP instead of the client IP address.

If you want to make sure that Azure and Cloudflare use the same IP address for geolocation, consider configuring the ClientIpHeaderTelemetryInitializer to take the IP address from a different header, for example CF-Connecting-IP or True-Client-IP headers that are set by Cloudflare (read more about Cloudflare headers here). Here is an example of how it can be configured for Application Insights https://apmtips.com/posts/2016-07-05-client-ip-address/

Please note that even with additional configuration geolocation results may still be slightly different between Azure and Cloudflare because they use different MaxMind products: GeoLite2 and GeoIP2.