When redirecting to Microsft, a state value has been generated and added to the /authorize URL. After a succesful login at Microsoft, this state value should be retourned to the CAS callback URL. The error you get occurs when the state parameter is missing.