Where do i enter a default PAT token for pull request decoration across all projects

We use azuredevops CI with pull request decoration from sonarcloud.
We want to use a single PAT token connected to an account with sufficient priviliges to be used when performing the decoration in all projects . The PAT token is generared in Azure, but i can not see an option anywhere in the portal to enter the PAT token for our organization.
Does a sonarcloud user need specific roles/rights to see this option ?
I am using an account that has the role ‘configuration owner’ in the azure sonarcloud enterprise application.

Hey there.

I think you’re looking for the organization-level binding.

Are you sure about that token being used for the pull request decoration ?
We had 2 PAT tokens associated with an account in azuredevops.
When 1 was invalid the analisys was still executed but the pull request decoration not.
I assumed there are 2 tokens we could connect to the organisation, 1 for scanning and 1 for pull request decoration

Yes, I’m sure. :slight_smile: Unless you have defined a token at the project-level (which takes precedence):

The organization token will be used.

Scanning will always be done with a SonarQube Cloud token. PR decoration is done with an Azure DevOps token.