Logging in MSAL.NET

The Microsoft Authentication Library (MSAL) apps generate log messages that can help diagnose issues. An app can configure logging with a few lines of code, and have custom control over the level of detail and whether or not personal and organizational data is logged. We recommend you create an MSAL logging callback and provide a way for users to submit logs when they have authentication issues.

Logging levels

MSAL provides several levels of logging detail:

  • Error: Indicates something has gone wrong and an error was generated. Used for debugging and identifying problems.
  • Warning: There hasn't necessarily been an error or failure, but are intended for diagnostics and pinpointing problems.
  • Info: MSAL will log events intended for informational purposes not necessarily intended for debugging.
  • Verbose: Default. MSAL logs the full details of library behavior.

Personal and organizational data

By default, the MSAL logger doesn't capture any highly sensitive personal or organizational data. The library provides the option to enable logging personal and organizational data if you decide to do so.

The following sections provide more details about MSAL error logging for your application.

Configure logging in MSAL.NET

In MSAL logging is set at application creation using the .WithLogging builder modifier. This method takes optional parameters:

  • Level enables you to decide which level of logging you want. Setting it to Errors will only get errors
  • PiiLoggingEnabled enables you to log personal and organizational data (PII) if set to true. By default this is set to false, so that your application does not log personal data.
  • LogCallback is set to a delegate that does the logging. If PiiLoggingEnabled is true, this method will receive messages that can have PII, in which case the containsPii flag will be set to true.
  • DefaultLoggingEnabled enables the default logging for the platform. By default it's false. If you set it to true it uses Event Tracing in Desktop/UWP applications, NSLog on iOS and logcat on Android.
class Program
  private static void Log(LogLevel level, string message, bool containsPii)
     if (containsPii)
        Console.ForegroundColor = ConsoleColor.Red;
     Console.WriteLine($"{level} {message}");

  static void Main(string[] args)
    var scopes = new string[] { "User.Read" };

    var application = PublicClientApplicationBuilder.Create("<clientID>")
                      .WithLogging(Log, LogLevel.Info, true)

    AuthenticationResult result = application.AcquireTokenInteractive(scopes)


See the MSAL.NET wiki for samples of MSAL.NET logging and more.

Next steps

For more code samples, refer to Microsoft identity platform code samples.