MSAL logs flows into AppInsights in Azure Functions

[jc4gh]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.5.0

Web app

Not Applicable

Web API

Protected web APIs call downstream web APIs

Token cache serialization

In-memory caches

Description

When we use Microsoft Identity Web on Azure Functions(v4, NET7, dotnet-isolated), Microsoft Identity Web and MSAL logs flow into App Insights as function user generated logs. Because they are categorized as Function..User, I can't filter them out with LogLevel.

Reproduction steps

1. Create Azure Function app and add AddMicrosoftIdentityWebApi
2. Dependency inject ILogger

Error message

No response

Id Web logs

No response

Relevant code snippets

services.AddAuthentication(sharedOptions =>
                    {
                        sharedOptions.DefaultScheme = Microsoft.Identity.Web.Constants.Bearer;
                        sharedOptions.DefaultChallengeScheme = Microsoft.Identity.Web.Constants.Bearer;
                    })
                        .AddMicrosoftIdentityWebApi(configuration)
                        .EnableTokenAcquisitionToCallDownstreamApi()
                        .AddDownstreamApi(nameof(WebService), configuration.GetSection("WebService"))
                        .AddInMemoryTokenCaches();

Regression

No response

Expected behavior

MSAL logs do not appear as default in Azure Functions, or show up as different category

[jennyf19]

How do the categories get determined?

[jc4gh]

I believe it does automatically. https://learn.microsoft.com/en-us/azure/azure-functions/configure-monitoring?tabs=v2#configure-categories

[jmprieur]

@jc4gh : do you mean that in Azure functions, you cannot set the log level per namespace individually? https://github.com/AzureAD/microsoft-identity-web/wiki/Logging ?

[jmprieur]

@jc4gh did you have time to have a look at the article I referenced?

[jc4gh]

No I can not, I've tried all different level, including "Microsoft.Identity", "Microsoft.Identity.Web"

[morten-b]

I can confirm the same behavior with this DI:

services.AddAzureClients(builder =>
{
    builder.AddSecretClient(keyVaultUri)
    .WithCredential(new EIPDefaultAzureCredential());
});

Possible relevant .csproj info:

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <AzureFunctionsVersion>v4</AzureFunctionsVersion>
    <OutputType>Exe</OutputType>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
  <ItemGroup>
    <FrameworkReference Include="Microsoft.AspNetCore.App" />
    <PackageReference Include="Microsoft.Azure.Functions.Worker" Version="1.21.0" />
    <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.1.0" />
    <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="1.2.1" />
    <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Timer" Version="4.3.0" />
    <PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="1.17.2" />
    <PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="2.22.0" />
    <PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="1.2.0" />
    <PackageReference Include="Microsoft.Extensions.Azure" Version="1.7.2" />
  </ItemGroup>

[absolutebandit]

We also ran into a similar issue just after migrating our functions to .NET 8/Isolated Process. We added the worker logging configuration in our appsettings.json but had mistakenly put the log categories in the wrong section of the file. We started seeing "False MSAL ..." logs everywhere but the came from our function user category "Function.XXXXX.User". This seems very strange. In the end we discovered the mistake in the app settings file and once corrected the unwanted logs were surpressed correctly. So I guess that even though the logs appear to come from the "Function.XXXXX.User" category the suppression categories still work because in our config we had "Azure.Identity": "Warning". Maybe this is a bug or side-effect of running in isolated process.