diff --git a/includes/class-m365-login-auth.php b/includes/class-m365-login-auth.php
index 810e99a..9368cd7 100644
--- a/includes/class-m365-login-auth.php
+++ b/includes/class-m365-login-auth.php
@@ -796,6 +796,17 @@ class M365_Login_Auth {
 		);
 	}
 
+	/**
+	 * Writes a diagnostic line to the debug log (only with WP_DEBUG and WP_DEBUG_LOG; never tokens or secrets).
+	 *
+	 * @param string $message Message.
+	 */
+	private function log( $message ) {
+		if ( defined( 'WP_DEBUG' ) && WP_DEBUG && defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) {
+			error_log( '[M365 Login] ' . $message ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+		}
+	}
+
 	/**
 	 * Aborts the flow and shows a generic error on the login screen.
 	 *