msal python ConfidentialClientApplication class does not support verify param

Please pay special attention to the following use case, as it is needed for production usage of the app:

verify='/path/to/certfile'

Hey there! You’re right—today’s MSAL-Python ConfidentialClientApplication constructor doesn’t have a top-level verify argument you can just drop in. Internally MSAL uses the requests library to call the token endpoint, so you can work around it in one of two ways:

1. Use the standard REQUESTS_CA_BUNDLE env var
   • Set REQUESTS_CA_BUNDLE=/path/to/your/ca-chain.pem in the environment that runs your app.
   • MSAL’s underlying requests calls will pick that up automatically and use your custom cert bundle for SSL verification.
2. Inject a custom HTTP client (requests.Session)
   • Build a requests.Session() yourself, point its .verify attribute at your cert, and hand it to MSAL via the http_client parameter.
   • Example:

     
          import msal
     
          import requests
     
          # Create a session that uses your cert bundle
     
          session = requests.Session()
     
          session.verify = "/path/to/your/ca-chain.pem"
     
          app = msal.ConfidentialClientApplication(
     
              client_id="YOUR_CLIENT_ID",
     
              authority="https://login.microsoftonline.com/YOUR_TENANT_ID",
     
              client_credential="YOUR_CLIENT_SECRET",
     
              http_client=session,   # <-- MSAL will use this under the covers
     
          )
     
          result = app.acquire_token_for_client(scopes=["https://graph.microsoft.com/.default"])
     
          print(result)
     
     

Either approach lets you enforce SSL certificate checks against your own chain without waiting for MSAL to ship a first-class verify parameter.

Hope that helps!

Reference list:

• MSAL Python ConfidentialClientApplication API https://learn.microsoft.com/python/api/msal/msal.application.confidentialclientapplication
• MSAL Python advanced client-credentials (shows how MSAL calls requests under the covers) https://learn.microsoft.com/entra/msal/python/advanced/client-credentials
• Python requests SSL cert verification docs https://docs.python-requests.org/en/v2.9.1/user/advanced/#ssl-cert-verification

Let me know if you hit any snags!

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.

Thanks for the prompt reply Rukmini!

If the verify param isn't usable, should it be removed from the constructor?

Hello msal_ConfidentialClientApplication_verify

We will check internally and get back to you!

The suggested code doesn't work on a secured environment.

(Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)'))