diff --git a/addons/microsoft_account/controllers/main.py b/addons/microsoft_account/controllers/main.py
index 63aa82bf937..8326427ccf7 100644
--- a/addons/microsoft_account/controllers/main.py
+++ b/addons/microsoft_account/controllers/main.py
@@ -2,6 +2,7 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 import json
+from werkzeug.exceptions import BadRequest
 
 from odoo import http
 from odoo.http import request
@@ -12,10 +13,11 @@ class MicrosoftAuth(http.Controller):
     @http.route('/microsoft_account/authentication', type='http', auth="public")
     def oauth2callback(self, **kw):
         """ This route/function is called by Microsoft when user Accept/Refuse the consent of Microsoft """
-        state = json.loads(kw['state'])
-        dbname = state.get('d')
+        state = json.loads(kw.get('state', '{}'))
         service = state.get('s')
         url_return = state.get('f')
+        if (not service or (kw.get('code') and not url_return)):
+            raise BadRequest()
 
         if kw.get('code'):
             access_token, refresh_token, ttl = request.env['microsoft.service']._get_microsoft_tokens(kw['code'], service)