AZURE_CLI_DISABLE_CONNECTION_VERIFICATION does not pass verify=False to MSAL, breaking az login behind TLS proxies

[saladbkp]

Summary

AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 does not work for az login because the verify=False parameter is never passed to MSAL's PublicClientApplication. The env var only affects post-auth API requests (via _debug.py), not the initial OIDC discovery request that MSAL makes during login.

Reproduction

export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1
az login --use-device-code
# ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443):
# Max retries exceeded ... SSLCertVerificationError

Environment

• azure-cli 2.82.0
• Python 3.13.11
• Behind Zscaler TLS inspection proxy

Root cause

In azure/cli/core/auth/identity.py, _msal_app_kwargs does not include verify:

@property
def _msal_app_kwargs(self):
    return {
        "authority": self._msal_authority,
        "token_cache": Identity._msal_token_cache,
        "http_cache": Identity._msal_http_cache,
        "instance_discovery": self._instance_discovery,
        "client_capabilities": None if "AZURE_IDENTITY_DISABLE_CP1" in os.environ else ["CP1"]
        # ← no "verify" parameter
    }

MSAL's PublicClientApplication.__init__ accepts a verify parameter (defaults to True) and passes it to requests.Session().verify. Since _msal_app_kwargs never sets it, the initial OIDC discovery request to login.microsoftonline.com always uses verify=True.

Meanwhile, _debug.py:change_ssl_cert_verification() only patches the post-auth client session — it never runs during az login.

Suggested fix

@property
def _msal_app_kwargs(self):
    from ..util import should_disable_connection_verify
    kwargs = {
        "authority": self._msal_authority,
        "token_cache": Identity._msal_token_cache,
        "http_cache": Identity._msal_http_cache,
        "instance_discovery": self._instance_discovery,
        "client_capabilities": None if "AZURE_IDENTITY_DISABLE_CP1" in os.environ else ["CP1"]
    }
    if should_disable_connection_verify():
        kwargs["verify"] = False
    return kwargs

Note

Even with this fix, there is a second blocker: urllib3 2.6.0 unconditionally sets VERIFY_X509_STRICT on Python 3.13, which makes verify=False ineffective at the OpenSSL level. See: urllib3/urllib3#5110.

Both fixes are needed for az login to work behind TLS inspection proxies on Python 3.13.

[azure-client-tools-bot-prd]

Hi @saladbkp,

2.82.0 is not the latest Azure CLI(2.88.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[saladbkp]

Thanks for the quick response. I've upgraded to azure-cli 2.88.0 (Python 3.14.6, urllib3 2.7.0).

The bug is still present in 2.88.0. I can confirm by code inspection:

1. azure/cli/core/auth/identity.py — _msal_app_kwargs still does not include verify:

# identity.py lines 102-109 in azure-cli 2.88.0
return {
    "authority": self._msal_authority,
    "token_cache": Identity._msal_token_cache,
    "http_cache": Identity._msal_http_cache,
    "instance_discovery": self._instance_discovery,
    "client_capabilities": None if "AZURE_IDENTITY_DISABLE_CP1" in os.environ else ["CP1"]
    # ← still no "verify" parameter
}

2. urllib3 2.7.0 (bundled with azure-cli 2.88.0) still unconditionally sets VERIFY_X509_STRICT on Python 3.13+ (ssl_.py lines 290-292).

The code path is version-independent — _msal_app_kwargs has not changed between 2.82.0 and 2.88.0.

[yonzhan]

az login