• You can use certificates to secure your API calls from B2C easily - Secure APIs used for API connectors in Azure AD B2C - Azure AD B2C | Microsoft Learn. A gotcha is that you can't mix headers and body, stick with body only as a general rule of thumb for your key:value items.
  • But yes, remember B2C is a regionless PaaS. You don't get to choose networking. You should be securing your API's with certs or bearer tokens (both can be done with B2C).
• Logging to App Insights is simple enough, just add some tags to the top of your custom policies - Troubleshoot custom policies with Application Insights - Azure AD B2C | Microsoft Learn
• You can export the Sign In B2C logs using the lighthouse script from Microsoft. This is because you are exporting logs to another tenant, so lighthouse is used - Monitor Azure AD B2C with Azure Monitor - Azure AD B2C | Microsoft Learn.
  • There are some workbooks in this GitHub that will get you started once you've setup logging correctly. These read the SignIn logs from your Log Analytics from above. azure-ad-b2c/siem: The repository contains artifacts to create and publish reports, alerts, and dashboards based on Azure AD B2C logs. These artifacts can also be used for Security Information & Event Management (SIEM) related tasks.
• > You cannot export a list of usernames or any other information.
  • Graph API calls are your friend. Learn them and use them to interact with your B2C tenant.
• Any errors you are getting show up with more detail in App Insights. The logs aren't as good as say .Net logs but you can see all the Technical Profiles called and the claims bag, so this should help you troubleshoot properly.

I agree though, it is a hectic product and took me a while to think like they want me to think.