# Check event exclusions before concluding that an Application Insights user flow is missing

> The visualization's settings can hide an event that requires separate investigation.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-149-check-event-exclusions-before-concluding-that-an-application-insights-user-flow-is/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:31+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

The visualization's settings can hide an event that requires separate investigation.

## Potentially affected

Use this review for a particular page view or custom event expected in an Application Insights user-flow view. Identify the intended event name, application resource and observation window. A missing visual node does not on its own distinguish a display setting from missing instrumentation.

## DSE recommendation

DSE recommends preserving the original visualization settings before investigating.

## Article

## Source facts

Microsoft advises checking excluded events, expanding Others nodes and widening the time range for infrequently reported events when reviewing a user-flow visualization. It also directs operators to confirm that the expected event type is configured for collection in the application’s SDK instrumentation. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/usage).

## Applicability

Use this review for a particular page view or custom event expected in an Application Insights user-flow view. Identify the intended event name, application resource and observation window. A missing visual node does not on its own distinguish a display setting from missing instrumentation.

## DSE recommendation

DSE recommends preserving the original visualization settings before investigating. Check its exclusions and grouping first, then compare the expected event with the application’s instrumentation contract. Use an agreed test interaction rather than assuming what real users did. Keep the flow view’s exploratory purpose separate from any precise conversion calculation required by the business.

## Verification

Perform the approved interaction and confirm whether the corresponding event arrives in the intended telemetry resource. Then check whether it appears after the relevant visualization settings are adjusted. Record collection and display outcomes separately. If the event still does not appear, retain its expected name and test timestamp for the application owner rather than editing the business conclusion to match the empty view.

## Official references

[Microsoft Learn: Usage analysis with Application Insights | Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/app/usage).

## Primary reference

- Name: Usage analysis with Application Insights - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/app/usage
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check event exclusions before concluding that an Application Insights user flow is missing,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-149-check-event-exclusions-before-concluding-that-an-application-insights-user-flow-is/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.