All Users in Application Insights and Active users' data in azure monitor workbook not matching

Question

Could someone please explain why the All-users data (In usage section of App Insights) and Active users' data in Azure Monitor workbook called "Active Users" not matching. I am assuming that All users and active users are the same. For example, all users in App insights shows 23.73k users During last 24 hours, Show (All Users), who used (Any custom Events, Request or Page View), Events (All) and split by none. However, the Active users workbook shows 24.2k for Metric (Daily Active Users), Activities (All Events and Page Views)?

All Users (From Application Insights)

All Users

Query used by the All Users

let usg_events = dynamic(["*"]);
let grain = iff(true, 1h, 1h);
let mainTable = union pageViews, customEvents, requests
    | where timestamp > ago(1d)
    | where isempty(operation_SyntheticSource)
    | extend name =replace("\n", "", name)
    | extend name =replace("\r", "", name)
    | where '*' in (usg_events) or name in (usg_events);
let resultTable = mainTable;
resultTable
| make-series Users = dcountif(user_Id, user_Id != user_AuthenticatedId or (user_Id == user_AuthenticatedId and isnotempty(user_Id))) default = 0 on timestamp from ago(1d) to now() step grain
| render barchart

Azure Monitor

Active Users

Query used by Azure Monitor Workbook for active users

let start = startofday(ago(1d));
union customEvents, pageViews
| where timestamp >= start
| where name in ('*')
    or '*' in ('*')
    or ('%' in ('*') and itemType == 'pageView')
    or ('#' in ('*') and itemType == 'customEvent')
| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Views = count()
| evaluate narrow()
| project
    Title = case(Column == 'Users', 'Active Users', Column == 'Sessions', 'Unique Sessions', 'Views'),
    Metric = Value,
    SubTitle = '━━'

If I edit the Azure Monitor Query to use time Range (i.e. Last 24 hours) then it matches the number of users with App Insights and If I used the "Set in Query" parameter then the users data is not matching. I couldn't understand why? could someone please help me?

Answer 1

The difference between these two queries is the time range they use for comparison. The first query takes users from the last 24 hours:

| where timestamp > ago(1d) 

While the second query takes users from the start of the previous day:

let start = startofday(ago(1d));
... 
| where timestamp >= start

As the second time range is longer (unless you run the query at midnight), the Active users query returns more users. When you override the date via Azure Monitor dropdown, it ignores the where condition set in the query and uses the same time range as in the All users query (last 24 hours).