does anyone know of a way to get the originating IP address in an AVD session or is the reverse nat going to pretty much hide all that?

Are you looking for ip of the user connecting to the session host? Or the external ip that would be seen from a session host connecting to a website or some other resource? Let me know if you need the users IP and i can get you the KQL Query.

im looking for the IP address of the workstation connecting into the AVD session.

My mistake, you used to be able to get the actual client ip but now all that is shown in the logs is internet facing ip. If thats all you need then you can just open log analytics and run the query. WVDConnections |project UserName, ClientSideIPAddress

yah i don't need to see the internal network of a user connecting to avd, just their external IP, so i can determine if the connection is coming from on prem network, or someone home network

Then that query above should work. We use that with powerbi to do a isp lookup and track ISP, active users, avg rtt and avg bw in a dashboard. We know all the ips for the users that connecting internal so it makes it easy to determine if they are in the office or external.

thx i will give it a shot.

I think you must be able to pull it off the AVD broker - https://www.eginnovations.com/blog/reverse-connect-azure-avd/ details doing this