# Include session-affinity traffic in an Application Gateway draining test

> Check what happens to established sessions when a backend leaves the pool.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:54+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Check what happens to established sessions when a backend leaves the pool.

## Potentially affected

Use this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway's affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.

## DSE recommendation

DSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client.

## Article

## Source facts

Application Gateway connection draining normally stops new requests to a deregistering backend while retaining existing connections until the configured timeout. Microsoft documents an exception: gateway-managed session affinity can continue sending requests to that backend. A gateway configuration update can also terminate ongoing connections when the draining timeout expires. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings).

## Applicability

Use this review for an Application Gateway backend-removal or configuration-change plan. Identify whether the application uses the gateway’s affinity cookie, the affected backend setting, and the longest transfers that the application owner expects to preserve.

## DSE recommendation

DSE recommends documenting separate expectations for a new client, an established transfer, and a returning affinity-bound client. Agree when the application team can shut down the removed backend. Choose the draining interval against the actual transfer requirement and current source limits, and retain a way to restore the approved backend membership if the rehearsal fails.

## Verification

During an approved rehearsal, send those three traffic patterns while removing one test backend. Correlate request destinations and transfer completion with removal and timeout timestamps. Repeat the relevant configuration-update case. Record any request still reaching the old backend before declaring it ready for shutdown.

## Official references

[Microsoft Learn: Azure Application Gateway Backend Settings configuration](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings).

## Primary reference

- Name: Azure Application Gateway Backend Settings configuration | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Include session-affinity traffic in an Application Gateway draining test,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-006-include-session-affinity-traffic-in-an-application-gateway-draining-test/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.