Getting started with Azure DevOps
If your code is on Azure DevOps, go to sonarcloud.io and click
You will be taken to the Microsoft login page. Sign in using your Microsoft credentials.
Welcome to SonarCloud
Once you have successfully logged in, you will see the SonarCloud welcome screen.
Click on Import projects from Azure.
Set up your organization
Connect your Azure DevOps organization with SonarCloud
You will be presented with a screen like this:
You need to enter the name of your Azure DevOps organization and a personal access token created in that organization.
To create the token, go to your Azure DevOps organization and click through to User settings > Personal access tokens, then click + New token.
On the next page, under Scopes, make sure that you specify at least the scope Code > Read & write.
Then click Create.
When the personal access token is displayed, copy it and paste it into the field in the SonarCloud setup page.
Additionally, in your Azure DevOps organization, you will need to ensure that Azure Active Directory Conditional Access Policy Validation is disabled. Go to Organization Settings > Security > Policies > Enable Azure Active Directory Conditional Access Policy Validation and ensure that the feature is turned off.
Location of Personal Access Tokens in SonarCloud
When you set up your connection to Azure DevOps as described here, your Azure DevOps organization is bound to SonarCloud and the PAT from the Azure organization is registered at the SonarCloud organization level (not at the SonarCloud project level). If you later need to update the value of this token you can find it under Your Organization > Administration > Organization Settings > Azure DevOps connectivity management.
If you earlier set up an Azure DevOps project manually (not creating a bound organization) you may have registered the PAT at the SonarCloud project level (not the organization level) by filling the field under Your Organization > Your Project > Administration > General Settings > Integration with Azure DevOps Services.
Entering the PAT at the organization vs the project level in SonarCloud can lead to differing behavior. We recommend that you follow the tutorial to create a bound organization and make sure that the PAT is entered only at the organization level, not at the project level. The project-level field should be left blank.
Use a technical user
We strongly encourage you to add a technical user to your organization, log in to SonarCloud using that technical user, and use the access token of that technical user to connect your Azure DevOps organization to SonarCloud.
Create your SonarCloud organization
SonarCloud is set up to mirror the way that code is organized in Azure DevOps (and other repository providers):
- Each SonarCloud project corresponds one-to-one with an Azure DevOps project, which resides in its own Git repository.
- Azure DevOps projects are grouped into Azure DevOps organizations.
- Each SonarCloud organization corresponds one-to-one with an Azure DevOps organization.
In this step, you will create a SonarCloud organization that corresponds to your Azure DevOps organization.
SonarCloud will suggest a key for your SonarCloud organization. This is a name unique across all organizations within SonarCloud. You can accept the suggestion or change it manually. The interface will prevent you from changing it to an already existing key.
SonarCloud does not support linking an organization to more than one DevOps platform. If you want to link to more than one, you will need to create a separate organization to link to each DevOps service.
Choose a plan
Next, you will be asked to choose a SonarCloud subscription plan. If all the repositories to be analyzed are public on Azure DevOps then you can choose the free plan. Your code and analysis results will be publicly accessible at sonarcloud.io.
If you want to analyze one or more private repositories then you need to select a paid plan. Even with the paid plan you still have a 14 day free trial period. Once the 14 days have elapsed, the cost is based on the number of lines of code analyzed.
A plan is always associated one-to-one with a SonarCloud organization and therefore with a single Azure DevOps organization. If you want to onboard multiple Bitbucket workspaces, you must sign up for a separate plan for each.
Once you have chosen a plan and clicked Create Organization, your SonarCloud organization will be created!
Set up your analysis
The next step is to import the projects (that is, individual Git repositories) that you want to analyze from your Azure DevOps organization into your newly created SonarCloud organization, creating a corresponding SonarCloud project for each.
SonarCloud will present a list of the repositories in your Azure DevOps organization. Select those that you want to import and analyze and click Set Up.
The selected projects will be imported.
With Azure DevOps projects the actual analysis is performed in your build environment (cloud CI, local machine, etc.). This means you have to configure your build process to perform the analysis on each build and communicate the results up to SonarCloud.
We refer to this analysis method as CI-based analysis (though it may take place in a cloud CI or a manually configured build environment) to contrast it with automatic analysis which works by SonarCloud directly accessing your repository and performing the analysis itself. However, automatic analysis is currently available only for GitHub projects and only for a subset of languages. It is currently not available for Azure DevOps projects.
SonarCloud will guide you through a tutorial on how to set up your build environment to perform analysis.
The first step is to select your build environment. SonarCloud will present this page:
If you have no particular preference and are setting up a new project on Azure DevOps, we recommend using Azure DevOps Pipelines as your CI.
Follow the tutorial to set up your analysis.
See your analysis results
Once your analysis is complete, SonarCloud will display your analysis results.
Once it is complete, you can view the results of your first analysis.
If you log into SonarCloud using an email address that you previously used to log into another DevOps platform, you need to be aware that SonarCloud will automatically associate your email address with the new DevOps platform. For example, if you log in through Azure DevOps and previously used GitHub, GitHub issues will no longer be assigned to your email address and you will stop receiving GitHub email notifications. If you then decide to switch back to GitHub, the Azure DevOps email notifications will be discontinued.