diff --git a/src/azure-cli-core/HISTORY.rst b/src/azure-cli-core/HISTORY.rst
index eca3c0077c2..cfa9a304483 100644
--- a/src/azure-cli-core/HISTORY.rst
+++ b/src/azure-cli-core/HISTORY.rst
@@ -7,6 +7,7 @@ Release History
 ++++++
 * Resolve CVE-2026-48526 (#33562)
 * Update global policy argument `--acquire-policy-token` to pick up new api-version and propagate correlation-id (#33661)
+* `az login`: Pass `verify=False` to MSAL when `AZURE_CLI_DISABLE_CONNECTION_VERIFICATION` is set, so login works behind TLS inspection proxies (#33716)
 
 2.87.0
 ++++++
diff --git a/src/azure-cli-core/azure/cli/core/auth/identity.py b/src/azure-cli-core/azure/cli/core/auth/identity.py
index 91629e89441..55ea60986b4 100644
--- a/src/azure-cli-core/azure/cli/core/auth/identity.py
+++ b/src/azure-cli-core/azure/cli/core/auth/identity.py
@@ -99,7 +99,8 @@ def _msal_app_kwargs(self):
         if self._use_msal_http_cache and not Identity._msal_http_cache:
             Identity._msal_http_cache = self._load_msal_http_cache()
 
-        return {
+        from ..util import should_disable_connection_verify
+        kwargs = {
             "authority": self._msal_authority,
             "token_cache": Identity._msal_token_cache,
             "http_cache": Identity._msal_http_cache,
@@ -107,6 +108,11 @@ def _msal_app_kwargs(self):
             # CP1 means we can handle claims challenges (CAE)
             "client_capabilities": None if "AZURE_IDENTITY_DISABLE_CP1" in os.environ else ["CP1"]
         }
+        # Honor AZURE_CLI_DISABLE_CONNECTION_VERIFICATION for MSAL requests (such as the OIDC
+        # discovery request during login), so that login works behind TLS inspection proxies.
+        if should_disable_connection_verify():
+            kwargs["verify"] = False
+        return kwargs
 
     @property
     def _msal_public_app_kwargs(self):
diff --git a/src/azure-cli-core/azure/cli/core/auth/tests/test_identity.py b/src/azure-cli-core/azure/cli/core/auth/tests/test_identity.py
index 993039faca3..45b888b4d23 100644
--- a/src/azure-cli-core/azure/cli/core/auth/tests/test_identity.py
+++ b/src/azure-cli-core/azure/cli/core/auth/tests/test_identity.py
@@ -177,6 +177,18 @@ def test_logout_service_principal(self, init_mock, remove_tokens_for_client_mock
         remove_tokens_for_client_mock.assert_called_once()
         remove_entry_mock.assert_called_with(client_id)
 
+    def test_msal_app_kwargs_verify_default(self):
+        # By default, no 'verify' kwarg is passed to MSAL apps.
+        identity = Identity('https://login.microsoftonline.com')
+        assert 'verify' not in identity._msal_app_kwargs
+
+    def test_msal_app_kwargs_disable_connection_verify(self):
+        # When AZURE_CLI_DISABLE_CONNECTION_VERIFICATION is set, verify=False is passed to MSAL apps
+        # so that login works behind TLS inspection proxies.
+        with mock.patch.dict(os.environ, {"AZURE_CLI_DISABLE_CONNECTION_VERIFICATION": "1"}):
+            identity = Identity('https://login.microsoftonline.com')
+            assert identity._msal_app_kwargs['verify'] is False
+
 
 class TestServicePrincipalAuth(unittest.TestCase):