Azure Devops and SonarCloud tokens management

[Colin]

Hey there.

Happy to read a thread where someone wants to manage fewer tokens rather than more in the name of security.

@olivier.thomas

At the end, we have many ServiceConnections in the different Azure Devops projects, and each has his own tokens for the different repos (applications)

We have an old Community Guide about Microsoft’s guidance for sharing connections across projects in an organization.

DRY: You can (probably) share your SonarQube server connection across projects in Azure DevOps!

A question that comes up semi-frequently regarding Azure DevOps pipelines is: why do I have to set up a SonarQube (or Cloud) server connection for every project I want analyzed? The answer: you probably don’t have to. Microsoft has documented the means by which you can share these connections across projects within an organization. Why do I say ‘probably?’ Because, as noted in the MS doc, this isn’t necessarily rolled out to all organizations within Azure, although they say you can request it.…

I would hope that almost 2 years on, this is available to all users. I would suggest looking at the Microsoft documentation linked and see what’s available in your context.

@olivier.thomas

Also, in SonarCloud, on the PullRequest tab settings of the project, we include the PAT generated by Azure Devops on the User profile.

In fact, it’s an oddity that you can set this at the project-level at all (this is not how it works for any other DevOps Platform that SonarCloud integrates with). We’d actually rather that users not use this at all and instead have a single token configured under the organization-level Administration > Organization settings > Azure DevOps connectivity management.

I’ll refer to this documentation on Getting Started with Azure DevOps (that I’m actually really thrilled exists, as I’m only seeing it for the first time today).

Location of Personal Access Tokens in SonarCloud

When you set up your connection to Azure DevOps as described here, your Azure DevOps organization is bound to SonarCloud and the PAT from the Azure organization is registered at the SonarCloud organization level (not at the SonarCloud project level). If you later need to update the value of this token you can find it under Your Organization > Administration > Organization Settings > Azure DevOps connectivity management.

If you earlier set up an Azure DevOps project manually (not creating a bound organization) you may have registered the PAT at the SonarCloud project level (not the organization level) by filling the field under Your Organization > Your Project > Administration > General Settings > Integration with Azure DevOps Services.

Entering the PAT at the organization vs the project level in SonarCloud can lead to differing behavior. We recommend that you follow the tutorial to create a bound organization and make sure that the PAT is entered only at the organization level, not at the project level. The project-level field should be left blank.

I hope this helps.