How to get logs when the when the Claim to Role Mapper do not have roles when logged in

We have users added to Azure AD groups and using Mapper with claim to role mapper for mapping. But after logged in, user is getting access denied from the application and when checking the logs of app, we could see user is not assigned to the roles. I would like to enable logging in keycloak so that I can figure out user is not assigned to that AD group or not got the roles. How to enable logs for that?