SonarSource/sonarqube · error · IllegalArgumentException

Global personal access tokens ("All accessible organizations

Error message

Global personal access tokens ("All accessible organizations") are being retired by Microsoft and cannot be used. Create a personal access token scoped to a single organization.

What it means

checkPatIsNotGlobal rejects binding an Azure DevOps Services (Cloud) organization when the supplied PAT is a Global PAT scoped to 'All accessible organizations'. SonarQube probes the token via isGlobalPat and throws IllegalArgumentException with GLOBAL_PAT_ERROR_MESSAGE because Microsoft is retiring global PATs. Non-Cloud (Azure DevOps Server) URLs are exempt and probe failures fail open.

Source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/azure/AzureDevOpsValidator.java:73

  /**
   * Denies binding an Azure DevOps Services (Cloud) organization with a Global PAT ("All accessible
   * organizations"). Azure DevOps Server has no cross-org scope, so non-Cloud URLs are always allowed.
   * A probe failure (network error, Microsoft outage) is treated as inconclusive and fails open, so a
   * transient issue never blocks configuring a valid binding.
   */
  public void checkPatIsNotGlobal(String url, String pat) {
    if (!AzureDevOpsUrls.isAzureDevOpsServices(url)) {
      return;
    }
    boolean isGlobal;
    try {
      isGlobal = azureDevOpsHttpClient.isGlobalPat(pat);
    } catch (IllegalArgumentException e) {
      LOG.warn("Unable to determine whether the Azure DevOps personal access token is global, allowing the binding", e);
      return;
    }
    if (isGlobal) {
      throw new IllegalArgumentException(GLOBAL_PAT_ERROR_MESSAGE);
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

Create a new PAT in Azure DevOps scoped to a single organization (Applied to: pick the specific organization instead of 'All accessible organizations').
Update the SonarQube ALM setting with the new organization-scoped PAT.
If using Azure DevOps Server, no action needed — global scope restriction applies only to dev.azure.com URLs.

Example fix

// before (Azure DevOps UI): New PAT -> Applied to: All accessible organizations
// after: New PAT -> Applied to: my-organization, scopes: Code (Read & Write)

Defensive patterns

Strategy: validation

Validate before calling

// Before binding, ensure the PAT was created scoped to one organization:
// In Azure DevOps UI: User Settings > Personal Access Tokens > New Token > Applied to: <specific org>
// If isGlobalPat() returns true for a dev.azure.com URL, replace the token before saving the setting.

Try / catch

try {
  validator.checkPatIsNotGlobal(url, pat);
} catch (IllegalArgumentException e) {
  // GLOBAL_PAT_ERROR_MESSAGE: instruct admin to mint an org-scoped PAT
  showToUser("Create a PAT scoped to a single organization and retry.");
}

Prevention

When creating PATs, never leave 'Applied to' as 'All accessible organizations'.
Audit existing PATs in Azure DevOps and rotate any global ones to org-scoped.
Remember Server (on-prem) tokens are exempt — only dev.azure.com URLs are checked.

When it happens

Trigger: Calling checkPatIsNotGlobal with an https://dev.azure.com URL whose PAT's validFor/allOrganizations policy reports it as a global token (isGlobalPat returns true).

Common situations: Admin creating the PAT in Azure DevOps Cloud without selecting a specific organization under 'Applied to' (scope: All accessible organizations), a practice Microsoft is retiring; users migrating old global PATs created years ago.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/562cd16af7761831. Report an issue: GitHub.