troubleshoot-with-application-insights.md

title	titleSuffix	description	services	author	manager	ms.service	ms.workload	ms.topic	ms.date	ms.custom	ms.author	ms.subservice
Troubleshoot custom policies with Application Insights	Azure AD B2C	How to set up Application Insights to trace the execution of your custom policies.	active-directory-b2c	msmimart	celestedg	active-directory	identity	troubleshooting	08/26/2021	project-no-code	mimart	B2C

Collect Azure Active Directory B2C logs with Application Insights

This article provides steps for collecting logs from Active Directory B2C (Azure AD B2C) so that you can diagnose problems with your custom policies. Application Insights provides a way to diagnose exceptions and visualize application performance issues. Azure AD B2C includes a feature for sending data to Application Insights.

The detailed activity logs described here should be enabled ONLY during the development of your custom policies.

Warning

Do not set the DeploymentMode to Development in production environments. Logs collect all claims sent to and from identity providers. You as the developer assume responsibility for any personal data collected in your Application Insights logs. These detailed logs are collected only when the policy is placed in DEVELOPER MODE.

Set up Application Insights

If you don't already have one, create an instance of Application Insights in your subscription.

Tip

A single instance of Application Insights can be used for multiple Azure AD B2C tenants. Then in your query, you can filter by the tenant, or policy name. For more information, see the logs in Application Insights samples.

To use an exiting instance of Application Insights in your subscription, follow these steps:

1. Sign in to the Azure portal.
2. Select the Directory + subscription filter in the top menu, and then select the directory that contains your Azure subscription (not your Azure AD B2C directory).
3. Open the Application Insights resource that you created earlier.
4. On the Overview page, and record the Instrumentation Key

To create an instance of Application Insights in your subscription, follow these steps:

1. Sign in to the Azure portal.
2. Select the Directory + subscription filter in the top menu, and then select the directory that contains your Azure subscription (not your Azure AD B2C directory).
3. Select Create a resource in the left-hand navigation menu.
4. Search for and select Application Insights, then select Create.
5. Complete the form, select Review + create, and then select Create.
6. Once the deployment has been completed, select Go to resource.
7. Under Configure in Application Insights menu, select Properties.
8. Record the INSTRUMENTATION KEY for use in a later step.

Configure the custom policy

1. Open the relying party (RP) file, for example SignUpOrSignin.xml.

2. Add the following attributes to the <TrustFrameworkPolicy> element:

   DeploymentMode="Development"
   UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights"

3. If it doesn't already exist, add a <UserJourneyBehaviors> child node to the <RelyingParty> node. It must be located after <DefaultUserJourney ReferenceId="UserJourney Id" from your extensions policy, or equivalent (for example:SignUpOrSigninWithAAD" />.

4. Add the following node as a child of the <UserJourneyBehaviors> element. Make sure to replace {Your Application Insights Key} with the Application Insights Instrumentation Key that you recorded earlier.

   <JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="{Your Application Insights Key}" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />

   • DeveloperMode="true" tells ApplicationInsights to expedite the telemetry through the processing pipeline. Good for development, but constrained at high volumes. In production, set the DeveloperMode to false.
   • ClientEnabled="true" sends the ApplicationInsights client-side script for tracking page view and client-side errors. You can view these in the browserTimings table in the Application Insights portal. By setting ClientEnabled= "true", you add Application Insights to your page script and you get timings of page loads and AJAX calls, counts, details of browser exceptions and AJAX failures, and user and session counts. This field is optional, and is set to false by default.
   • ServerEnabled="true" sends the existing UserJourneyRecorder JSON as a custom event to Application Insights.

   For example:

   <TrustFrameworkPolicy
     ...
     TenantId="fabrikamb2c.onmicrosoft.com"
     PolicyId="SignUpOrSignInWithAAD"
     DeploymentMode="Development"
     UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights"
   >
   ...
   <RelyingParty>
     <DefaultUserJourney ReferenceId="UserJourney ID from your extensions policy, or equivalent (for example: SignUpOrSigninWithAzureAD)" />
     <UserJourneyBehaviors>
       <JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="{Your Application Insights Key}" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
     </UserJourneyBehaviors>
     ...
   </TrustFrameworkPolicy>

5. Upload the policy.

See the logs in Application Insights

There is a short delay, typically less than five minutes, before you can see new logs in Application Insights.

1. Open the Application Insights resource that you created in the Azure portal.
2. On the Overview page, select Logs.
3. Open a new tab in Application Insights.

Here is a list of queries you can use to see the logs:

Query	Description
traces	Get all of the logs generated by Azure AD B2C
`traces	where timestamp > ago(1d)`
`traces	where message contains "exception"
`traces	where customDimensions.Tenant == "contoso.onmicrosoft.com" and customDimensions.UserJourney == "b2c_1a_signinandup"`
`traces	where customDimensions.CorrelationId == "00000000-0000-0000-0000-000000000000"`

The entries may be long. Export to CSV for a closer look.

For more information about querying, see Overview of log queries in Azure Monitor.

See the logs in VS Code extension

We recommend you to install the Azure AD B2C extension for VS Code. With the Azure AD B2C extension, the logs are organized for you by the policy name, correlation ID (the application insights presents the first digit of the correlation ID), and the log timestamp. This feature helps you to find the relevant log based on the local timestamp and see the user journey as executed by Azure AD B2C.

Note

The community has developed the vs code extension for Azure AD B2C to help identity developers. The extension is not supported by Microsoft, and is made available strictly as-is.

Set Application Insights API access

After you set up the Application Insights, and configure the custom policy, you need to get your Application Insights API ID, and create API Key. Both the API ID and API key are used by Azure AD B2C extension to read the Application Insights events (telemetries). Your API keys should be managed like passwords. Keep it secret.

Note

Application Insights instrumentation key that your create earlier is used by Azure AD B2C to send telemetries to Application Insights. You use the instrumentation key only in your Azure AD B2C policy, not in the vs code extension.

To get Application Insights ID and key:

1. In Azure portal, open the Application Insights resource for your application.

2. Select Settings, then select API Access.

3. Copy the Application ID

4. Select Create API Key

5. Check the Read telemetry box.

6. Copy the Key before closing the Create API key blade and save it somewhere secure. If you lose the key, you'll need to create another.

   

Set up Azure AD B2C VS Code extension

Now the you have Azure Application insights API ID and Key, you can configure the vs code extension to read the logs. Azure AD B2C VS Code extension provides two scopes for settings:

• User Global Settings - Settings that apply globally to any instance of VS Code you open.
• Workspace Settings - Settings stored inside your workspace and only apply when the workspace is opened (using VS Code open folder).

1. From the Azure AD B2C Trace explorer, click on the Settings icon.

   

2. Provide the Azure Application Insights ID and key.

3. Click Save

After you save the settings the Application insights logs appear on the Azure AD B2C Trace (App Insights) window.

Configure Application Insights in Production

To improve your production environment performance and better user experience, it's important to configure your policy to ignore messages that are unimportant. Use the following configuration in production environments.

1. Set the DeploymentMode attribute of the TrustFrameworkPolicy to Production.

   <TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0"
   TenantId="yourtenant.onmicrosoft.com"
   PolicyId="B2C_1A_signup_signin"
   PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_signup_signin"
   DeploymentMode="Production"
   UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">

2. Set the DeveloperMode of the JourneyInsights to false.

   <UserJourneyBehaviors>
     <JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="{Your Application Insights Key}" DeveloperMode="false" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
   </UserJourneyBehaviors>

3. Upload and test your policy.

Next steps

• Learn how to troubleshoot Azure AD B2C custom policies