diff --git a/pkg/login/social/azuread_oauth.go b/pkg/login/social/azuread_oauth.go
index 384f36e56a2..656eb9f93f4 100644
--- a/pkg/login/social/azuread_oauth.go
+++ b/pkg/login/social/azuread_oauth.go
@@ -54,8 +54,10 @@ func (s *SocialAzureAD) UserInfo(_ *http.Client, token *oauth2.Token) (*BasicUse
 	}
 
 	role := extractRole(claims, s.autoAssignOrgRole)
+	logger.Debug("AzureAD OAuth: extracted role", "email", email, "role", role)
 
 	groups := extractGroups(claims)
+	logger.Debug("AzureAD OAuth: extracted groups", "email", email, "groups", groups)
 	if !s.IsGroupMember(groups) {
 		return nil, errMissingGroupMembership
 	}