SonarCloud creates GitLab Bot User

SonarCloud
,
2

Hey there.

SonarCloud itself creates no user – but we recommend using a technical user, as in the documentation you referenced: GitLab & SonarCloud

SonarCloud requires that the access token have api scope. This gives SonarCloud more access rights than strictly necessary, but due to the lack of more fine-grained access control in GitLab, it is the only viable option.

To mitigate this potential security concern, we strongly encourage you to add a technical user to your organization, log in to SonarCloud using that technical user, and use the access token of that technical user to connect your GitLab group to SonarCloud.

SonarCloud will always limit its actions to those required for effective integration with GitLab and will never use the full access right provided by the api scope.

You can read a bit more about the requirement for api scope here.

What seems most likely is that your customer followed this guidance and created a technical user.