Cannot provide an Azure DevOps access token: project '{}' is

Error message

Cannot provide an Azure DevOps access token: project '{}' is not bound to any DevOps Platform

What it means

AzureDevOpsScmAccessTokenProvider.resolveAzureDevOpsAlmSetting logs this warning and returns Optional.empty() when the project exists but projectAlmSettingDao.selectByProject finds no DevOps Platform binding for it. The project is not linked to any ALM binding, so no Azure DevOps access token can be minted. Like the other steps in mint(), this is an intentional soft-fail returning empty rather than throwing.

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/almsettings/azuredevops/AzureDevOpsScmAccessTokenProvider.java:104

    // DbSession above — see GitlabScmAccessTokenProvider for the same rationale.
    return resolvedAlmSetting.map(almSetting -> passThrough(safeProjectKey, almSetting));
  }

  /**
   * Walks project -&gt; its DevOps Platform binding -&gt; the bound {@link AlmSettingDto}, short-circuiting
   * to {@link Optional#empty()} (with a warning) at whichever step is missing, or once the binding
   * turns out not to be Azure DevOps.
   */
  private Optional<AlmSettingDto> resolveAzureDevOpsAlmSetting(DbSession dbSession, String projectKey, String safeProjectKey) {
    Optional<ProjectDto> project = dbClient.projectDao().selectProjectByKey(dbSession, projectKey);
    if (project.isEmpty()) {
      LOG.warn("Cannot provide an Azure DevOps access token: unknown project '{}'", safeProjectKey);
      return Optional.empty();
    }

    Optional<ProjectAlmSettingDto> projectAlmSetting = dbClient.projectAlmSettingDao().selectByProject(dbSession, project.get());
    if (projectAlmSetting.isEmpty()) {
      LOG.warn("Cannot provide an Azure DevOps access token: project '{}' is not bound to any DevOps Platform", safeProjectKey);
      return Optional.empty();
    }

    return dbClient.almSettingDao().selectByUuid(dbSession, projectAlmSetting.get().getAlmSettingUuid())
      .filter(almSetting -> almSetting.getAlm() == ALM.AZURE_DEVOPS);
  }

  private ScmAccessToken passThrough(String safeProjectKey, AlmSettingDto almSetting) {
    // AzureDevOpsValidator.validate() can fail with either IllegalArgumentException (bad config) or
    // NullPointerException (missing URL/PAT via requireNonNull) — caught here as RuntimeException,
    // rather than naming NullPointerException explicitly, to avoid catching it as a control-flow signal.
    try {
      azureDevOpsValidator.validate(almSetting);
    } catch (RuntimeException e) {
      throw new IllegalArgumentException(
        format("Cannot provide an Azure DevOps access token for project '%s': invalid Azure DevOps configuration: %s", safeProjectKey, e.getMessage()), e);
    }

View on GitHub (pinned to 184c821202)

Solutions

Bind the project to Azure DevOps: Project Settings > DevOps Platform Integration, or POST api/alm_settings/set_azure_devops with almSetting and project keys.
Ensure an Azure DevOps ALM configuration exists at global level (api/alm_integrations/create_azure_devops) before binding.
If binding was accidental, recreate it and retry the token request.
In automation, check the binding first via api/alm_settings/get_binding?project=<key> and skip/repair accordingly.

Example fix

// before: project 'my-app' has no DevOps Platform binding -> token request returns empty
// after
curl -u token: -X POST "$SQ_URL/api/alm_settings/set_azure_devops" \
  -d "project=my-app" -d "almSetting=ado-company" -d "repositoryName=org/repo"

Defensive patterns

Strategy: validation

Validate before calling

# Check binding before minting
BINDING=$(curl -s -u "$TOKEN:" "$SQ_URL/api/alm_settings/get_binding?project=$KEY")
if echo "$BINDING" | grep -q 'error'; then echo "Project not bound to a DevOps Platform; bind first" >&2; fi

Prevention

Include the DevOps Platform binding step in every project provisioning script.
Treat an empty token response as 'binding missing' and route to remediation.
Audit bindings periodically with api/alm_settings/get_binding.

When it happens

Trigger: Minting an Azure DevOps SCM access token for a projectKey that exists but has no entry in project_alm_settings (binding never created, or was deleted).

Common situations: Team created the SonarQube project manually instead of importing from Azure DevOps; the ALM binding was removed during cleanup; project imported under a different binding later unbound by an admin.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e2ae12bb456f1da9. Report an issue: GitHub.