{"record":{"id":"562cd16af7761831","repo":"SonarSource/sonarqube","slug":"global-personal-access-tokens-all-accessible-org","errorCode":null,"errorMessage":"Global personal access tokens (\"All accessible organizations\") are being retired by Microsoft and cannot be used. Create a personal access token scoped to a single organization.","messagePattern":"Global personal access tokens \\(\"All accessible organizations\"\\) are being retired by Microsoft and cannot be used\\. Create a personal access token scoped to a single organization\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/sonar-alm-client/src/main/java/org/sonar/alm/client/azure/AzureDevOpsValidator.java","lineNumber":73,"sourceCode":"  /**\n   * Denies binding an Azure DevOps Services (Cloud) organization with a Global PAT (\"All accessible\n   * organizations\"). Azure DevOps Server has no cross-org scope, so non-Cloud URLs are always allowed.\n   * A probe failure (network error, Microsoft outage) is treated as inconclusive and fails open, so a\n   * transient issue never blocks configuring a valid binding.\n   */\n  public void checkPatIsNotGlobal(String url, String pat) {\n    if (!AzureDevOpsUrls.isAzureDevOpsServices(url)) {\n      return;\n    }\n    boolean isGlobal;\n    try {\n      isGlobal = azureDevOpsHttpClient.isGlobalPat(pat);\n    } catch (IllegalArgumentException e) {\n      LOG.warn(\"Unable to determine whether the Azure DevOps personal access token is global, allowing the binding\", e);\n      return;\n    }\n    if (isGlobal) {\n      throw new IllegalArgumentException(GLOBAL_PAT_ERROR_MESSAGE);\n    }\n  }\n}\n","sourceCodeStart":55,"sourceCodeEnd":77,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-alm-client/src/main/java/org/sonar/alm/client/azure/AzureDevOpsValidator.java#L55-L77","documentation":"checkPatIsNotGlobal rejects binding an Azure DevOps Services (Cloud) organization when the supplied PAT is a Global PAT scoped to 'All accessible organizations'. SonarQube probes the token via isGlobalPat and throws IllegalArgumentException with GLOBAL_PAT_ERROR_MESSAGE because Microsoft is retiring global PATs. Non-Cloud (Azure DevOps Server) URLs are exempt and probe failures fail open.","triggerScenarios":"Calling checkPatIsNotGlobal with an https://dev.azure.com URL whose PAT's validFor/allOrganizations policy reports it as a global token (isGlobalPat returns true).","commonSituations":"Admin creating the PAT in Azure DevOps Cloud without selecting a specific organization under 'Applied to' (scope: All accessible organizations), a practice Microsoft is retiring; users migrating old global PATs created years ago.","solutions":["Create a new PAT in Azure DevOps scoped to a single organization (Applied to: pick the specific organization instead of 'All accessible organizations').","Update the SonarQube ALM setting with the new organization-scoped PAT.","If using Azure DevOps Server, no action needed — global scope restriction applies only to dev.azure.com URLs."],"exampleFix":"// before (Azure DevOps UI): New PAT -> Applied to: All accessible organizations\n// after: New PAT -> Applied to: my-organization, scopes: Code (Read & Write)","handlingStrategy":"validation","validationCode":"// Before binding, ensure the PAT was created scoped to one organization:\n// In Azure DevOps UI: User Settings > Personal Access Tokens > New Token > Applied to: <specific org>\n// If isGlobalPat() returns true for a dev.azure.com URL, replace the token before saving the setting.","typeGuard":null,"tryCatchPattern":"try {\n  validator.checkPatIsNotGlobal(url, pat);\n} catch (IllegalArgumentException e) {\n  // GLOBAL_PAT_ERROR_MESSAGE: instruct admin to mint an org-scoped PAT\n  showToUser(\"Create a PAT scoped to a single organization and retry.\");\n}","preventionTips":["When creating PATs, never leave 'Applied to' as 'All accessible organizations'.","Audit existing PATs in Azure DevOps and rotate any global ones to org-scoped.","Remember Server (on-prem) tokens are exempt — only dev.azure.com URLs are checked."],"tags":["azure-devops","pat","global-token","deprecation","configuration"],"backgroundTag":"deprecated-api-usage","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}