Pull Request decoration stops working after Azure DevOps PAT expiration and manual renewal

[etozherasmus (Ivan)]

ALM used

Azure DevOps

CI system used

Azure DevOps Pipelines

Scanner command used

Using the official SonarCloud Azure DevOps tasks:

• SonarCloudPrepare@4.2.5
• SonarCloudAnalyze@4.2.5
• SonarCloudPublish@4.2.5

(scanner configuration omitted as it is not relevant to the issue)

Languages of the repository

• C#
• TypeScript

SonarCloud project URL

Private project

Pull Request URL

Private Azure DevOps repository

Error observed

Our Azure DevOps PAT used by the SonarCloud Organization Binding expired.

As a result, the SonarCloudAnalyze task started failing with the following error:

ERROR: Error during SonarScanner execution
ERROR: Could not find the pullrequest with key 'REDACTED'
ERROR: Caused by: Error 404 on ... :
{"errors":[{"msg":"You don't have permission, or the provided pullrequest with key 'REDACTED' doesn't exist."}]}

After replacing the PAT under:

Organization → Organization Settings → Organization Binding

the pipeline started completing successfully again.

However, this exposed another issue.

The Pull Request is successfully created and visible in SonarCloud, analysis completes without errors, but Pull Request decoration no longer works—SonarCloud does not post comments back to the Azure DevOps Pull Request.

Our pipeline does not rely on SonarCloud Quality Gate branch policy to determine the Quality Gate status. We retrieve the result separately using our own PowerShell script that calls the project_status API. Therefore, the issue described here is limited to Pull Request decoration (comments in Azure DevOps).

While investigating the issue, I manually updated the project setting sonar.pullrequest.vsts.token.secured by calling:

POST /api/settings/set

with the following parameters:

key=sonar.pullrequest.vsts.token.secured
component=<projectKey>
value=<Azure DevOps PAT>

With the bearer authorization.

After this request, Pull Request decoration started working again without any other configuration changes.

This is confusing because in my case sonar.pullrequest.vsts.token.secured appears in the Settings search dropdown, but it is not available anywhere on the repository’s Pull Requests configuration page, so there is no obvious way to inspect or refresh it through the UI. Only the GitHub section is visible on this page, which in my case is completely irrelevant. The project is bounded with the corresponding Azure DevOps repository, as well as the organization.

During the investigation, I’ve found a screenshot from another issue in past that contained the necessary configuration.

In my case, the Pull Request view is missing necessary configuration section (Integration with Azure DevOps Services)

Steps to reproduce

Unfortunately, I don’t have reliable reproduction steps.

The issue appeared without any intentional configuration changes.

Observed sequence:

1. PR decoration had been working normally.
2. Upon the Azure DevOps PAT expiration and manual update of it, SonarCloud stopped decorating Pull Requests inside the Azure DevOps.
3. Manually refreshing sonar.pullrequest.vsts.token.secured through the API immediately restored PR decoration.

Potential workaround

Manually update the stored Azure DevOps token by sending the HTTP request that updates:

sonar.pullrequest.vsts.token.secured

After doing so, Pull Request decoration started working again immediately.

I’m willing to provide necessary private information regarding the configuration of organization & repository to the SonarQube representative for the further investigation.

[andres (Andrés García Solares)]

Hey @etozherasmus, thanks for sharing this. It is a known issue: as you found out, in the past it was possible to edit this token in the UI, now we’ve removed that but these token still remain and still override the org-level ones. We’re tracking this issue internally, I’ll let the devs know that you ran into it.

[JeroenGC (Jeroen)]

This was our issue too — thanks for posting it, and for the API workaround.

Worth adding for anyone searching: in our case the symptom wasn’t missing comments but the SonarCloud/quality gate status check on the PR staying in “waiting” indefinitely, which blocks merges. Analysis, branches and background tasks all reported success, so there was no signal pointing at a token at all. It took us several days to land on this thread.

We confirmed it by resetting sonar.pullrequest.vsts.token.secured on a few projects via the API — decoration and the status check resumed immediately. We’re now scripting that across all our projects, since any project bound while the UI field still existed likely carries a stale copy.

Could you share the reasoning behind removing the field? If project-level tokens are being phased out, a migration or even just a warning in the UI when one is present would prevent this failing silently for others.

[scott.bell]

Hi Ivan & Jeroen,

We’ve now released a self-service fix for this issue.

Go to Project → Administration → General Settings → Pull Requests. If a legacy project-level PAT is present, you’ll see a Legacy project-level PAT detected warning. Select Clear project-level PAT and confirm.

The project will then use the organization-level PAT. Make sure that PAT has the Azure DevOps Code (read & write) scope, then trigger a new pipeline run. You do not need to rebind the organization or reimport the project.

More details are available in our documentation.

Thanks for reporting this and helping us identify the problem.

-Scott