> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-cloud/quickstart-guides/quickstart-guide-enterprises.md).

# Quickstart guide for Enterprises

Set up SonarQube Cloud Enterprise from prerequisites through enterprise creation, organization onboarding, SSO, Advanced Security, and developer enablement.

If you're setting up SonarQube Cloud on the Team plan, use the [Quickstart guide](/sonarqube-cloud/quickstart-guides/quickstart-guide.md).

By completing this guide you will:

1. [Confirm your prerequisites](#confirm-your-prerequisites)
   1. [Choose your hosted region](#choose-your-hosted-region)
   2. [Prepare networking](#prepare-networking)
   3. [Prepare software and build agents](#prepare-software-and-build-agents)
   4. [Prepare authentication](#prepare-authentication)
   5. [Review trust and compliance documentation](#review-trust-and-compliance-documentation)
2. [Create your enterprise](#create-your-enterprise)
3. [Add your organizations to the enterprise](#add-your-organizations-to-the-enterprise)
4. [Enable enterprise capabilities](#enable-enterprise-capabilities)
   1. [Enable Advanced Security](#enable-advanced-security)
   2. [Configure SAML SSO and provisioning](#configure-saml-sso-and-provisioning)
5. [Roll out SonarQube for IDE and AI tooling](#roll-out-sonarqube-for-ide-and-ai-tooling)
6. [Review trust and compliance resources](#review-trust-and-compliance-resources)

## At a glance

| Area               | What to do                                                                                                              |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Region             | Use the EU region by default, or complete the [US region](#us-region) prerequisites before rollout.                     |
| Networking         | Allow communication between SonarQube Cloud, DevOps platforms, CI runners, and IDEs.                                    |
| Software           | Prepare a Java runtime for your scanners, SonarScanners, stack-specific build tools, and any Azure or SCA dependencies. |
| Authentication     | Start with a DevOps platform account that has the required role on the organization to import, then move to SSO.        |
| Enterprise setup   | Create the enterprise with your license key, then create or import your organizations from inside it.                   |
| Organization model | Create one SonarQube Cloud organization per DevOps organization or workspace.                                           |
| Optional products  | Enable Advanced Security through the Sonar team, then configure SSO and provisioning if needed.                         |
| Developer rollout  | Install SonarQube for IDE and optionally the SonarQube MCP Server for AI-assisted workflows.                            |

## Confirm your prerequisites

### Choose your hosted region

By default, SonarQube Cloud uses the EU region.

#### US region

If the US region is mandatory, contact the [Sales team](mailto:contact@sonarsource.com) before rollout so your domain can authenticate to the US region. After approval, follow the same process described in this guide, but replace `sonarcloud.io` with `sonarqube.us`. For details, see [Choosing your server region](/sonarqube-cloud/getting-started/choosing-your-region.md).

### Prepare networking

SonarQube Cloud requires bidirectional communication between your DevOps platform, CI pipelines or runners, and developer IDEs.

Before rollout:

* Review the required URLs and IP addresses in [Networking requirements](/sonarqube-cloud/appendices/networking-requirements.md).
* Allowlist the endpoints needed by SonarQube Cloud, your DevOps platform, your CI infrastructure, and developer workstations.
* If you plan to restrict enterprise access with an IP allow list after SSO is enabled, include the IPs used by enterprise admins, developers, CI runners, and token-based integrations. See [IP allow lists](/sonarqube-cloud/administering-sonarcloud/enterprise-security/ip-allow-lists.md).

### Prepare software and build agents

Make sure your build and analysis environment is ready before you onboard projects:

* Make sure your build agents meet the Java requirement for your scanner. Without JRE auto-provisioning, every scanner needs Java 21 or later. With auto-provisioning, the Maven and Gradle scanners need Java 11 or later, SonarScanner CLI needs Java 11 or later (Java 17 before version 7.2), and the .NET, NPM, and Python scanners need no local Java. See [General requirements](/sonarqube-cloud/analyzing-source-code/scanners/scanner-environment/general-requirements.md#required-java-versions).
* Identify the scanner or scanners required by your primary technology stacks:
  * [SonarScanner for Maven](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-maven.md)
  * [SonarScanner for Gradle](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-gradle.md)
  * [SonarScanner CLI](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-cli.md)
  * [SonarScanner for .NET](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-dotnet/introduction.md)
  * [SonarScanner for NPM](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-npm/introduction.md)
  * [SonarScanner for Python](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-python.md)
  * [Sonar's Build Wrapper](/sonarqube-cloud/analyzing-source-code/languages/c-family/prerequisites.md) for analyzing C/C++/Objective-C code
* Verify the supporting build tools on your agents:
  * [JavaScript/TypeScript/CSS](/sonarqube-cloud/analyzing-source-code/languages/javascript-typescript-css.md#nodejs) for JavaScript and TypeScript analysis
  * [SonarScanner for Maven](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-maven.md) or [SonarScanner for Gradle](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-gradle.md) for Java builds
  * [Installing the scanner](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-for-dotnet/installing.md) for C# analysis
* If you use Azure DevOps Pipelines, install the [SonarQube extension for Azure DevOps](https://marketplace.visualstudio.com/items?itemName=SonarSource.sonarcloud).
* If you plan to use Advanced Security, review [Analyzing projects for dependencies (SCA)](/sonarqube-cloud/advanced-security/analyzing-projects-for-dependencies-sca.md) to confirm any additional build tool, lockfile, or package manager requirements.

### Prepare authentication

The person who performs the setup signs in with a DevOps platform account. To import an organization, the account needs this role on the DevOps platform:

* GitHub: owner of the GitHub organization
* GitLab: owner of the GitLab group
* Bitbucket Cloud: administrator of the Bitbucket workspace
* Azure DevOps: administrator of the Azure DevOps organization

Before rollout:

* Confirm that the account has this role on every organization or workspace you plan to import.
* If needed, install the SonarQube Cloud marketplace application or grant the required access described in [Default authentication through DevOps platform](/sonarqube-cloud/administering-sonarcloud/about-sonarqube-cloud-solution/user-management/devops-platform-authentication.md).
* Plan to configure [Setting up SSO](/sonarqube-cloud/getting-started-with-enterprise/setting-up-sso.md) after the enterprise is created. Enterprise users still start by signing up with their DevOps platform account.

## Create your enterprise

Create the enterprise first, then add organizations to it. You do not need an existing organization: you create or import the first one while you create the enterprise.

1. In SonarQube Cloud, select the **+** menu in the top-right corner.
2. Select **Create new enterprise**.
3. Enter the license key provided by Sonar.
4. Enter the enterprise name and enterprise key.
5. Create or import your first organization, or add an existing one. An organization added to the enterprise is assigned the Enterprise plan.
6. Select **Create Enterprise**.

For the full workflow, see [Setting up your enterprise](/sonarqube-cloud/getting-started-with-enterprise/setting-up-your-enterprise.md#create-enterprise).

After creation, review [Managing the enterprise-related permissions](/sonarqube-cloud/administering-sonarcloud/managing-enterprise/managing-the-enterprise-related-permissions.md) and make sure the right users can administer the enterprise and create portfolios.

## Add your organizations to the enterprise

SonarQube Cloud uses a one-to-one model: one SonarQube Cloud organization is bound to one DevOps organization or workspace. If you need to connect multiple DevOps platforms or multiple organizations, create a separate SonarQube Cloud organization for each one. For background, see [Binding with the DevOps platform](/sonarqube-cloud/administering-sonarcloud/about-sonarqube-cloud-solution/resources-structure/binding-with-dop.md) and [Organization](/sonarqube-cloud/administering-sonarcloud/about-sonarqube-cloud-solution/resources-structure/organization.md).

After the enterprise exists, add the rest of your organizations from the enterprise's **Organizations** page. Organizations you create or import there join the enterprise on the Enterprise plan. See [Adding organizations to your enterprise](/sonarqube-cloud/administering-sonarcloud/managing-enterprise/adding-organizations-to-your-enterprise.md).

{% hint style="info" %}
Select the Free plan only when you import a standalone organization outside the enterprise and plan to add it to the enterprise later. The organization moves to the Enterprise plan when you add it.
{% endhint %}

Use the import path that matches your DevOps platform:

* [Importing GitHub.com organization](/sonarqube-cloud/administering-sonarcloud/managing-organization/creating-organization/importing-github-organization.md): grant the SonarQube Cloud application access to the organization.
* [Importing GHE.com Cloud organization](/sonarqube-cloud/administering-sonarcloud/managing-organization/creating-organization/importing-ghecom-cloud-organization.md): only available from within an existing enterprise, not the **+** menu > **Create new organization** flow.
* [Importing GHES organization](/sonarqube-cloud/administering-sonarcloud/managing-organization/creating-organization/importing-ghes-organization.md): only available from within an existing enterprise, not the **+** menu > **Create new organization** flow.
* [Importing Bitbucket workspace](/sonarqube-cloud/administering-sonarcloud/managing-organization/creating-organization/importing-bitbucket-workspace.md): grant the SonarQube Cloud application access to the workspace.
* [Importing GitLab group](/sonarqube-cloud/administering-sonarcloud/managing-organization/creating-organization/importing-gitlab-group.md): create and provide a Personal Access Token from an owner or dedicated technical account.
* [Importing Azure DevOps organization](/sonarqube-cloud/administering-sonarcloud/managing-organization/creating-organization/importing-azure-devops-organization.md): create and provide a Personal Access Token from an administrator or dedicated technical account.

## Enable enterprise capabilities

### Enable Advanced Security

Advanced Security is enabled by the Sonar team.

To request it:

1. Open the enterprise in SonarQube Cloud.
2. Copy the enterprise ID from the browser URL, for example `https://sonarcloud.io/enterprise/<your-enterprise-id>`.
3. Provide that ID to your Sonar contact or Sonar team.
4. Wait for confirmation that Advanced Security has been enabled.

Once enabled, use [Analyzing projects for dependencies (SCA)](/sonarqube-cloud/advanced-security/analyzing-projects-for-dependencies-sca.md) to configure dependency analysis.

### Configure SAML SSO and provisioning

After the enterprise exists, you can transition from DevOps-platform authentication to SAML SSO. For the full procedure, including a pilot rollout and rollback guidance, see [Transition from DevOps-platform authentication to SSO](/sonarqube-cloud/quickstart-guides/transition-from-devops-platform-authentication-to-sso.md).

Use this rollout order:

1. Review [Setting up SSO](/sonarqube-cloud/getting-started-with-enterprise/setting-up-sso.md) for the enterprise-level flow.
2. Configure SAML in [Set up SSO](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-sso.md).
3. Decide whether you will provision users with [Set up SCIM](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-scim.md) or [About SSO and provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/about.md#just-in-time).
4. Map IdP groups to SonarQube Cloud organizations with [Set up SCIM](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-scim.md#map-groups).
5. Complete the setup with [Invite users to sign in](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/complete-setup.md).
6. Verify the resulting organization access with [Managing user groups](/sonarqube-cloud/administering-sonarcloud/managing-organization/users-and-permissions/user-groups.md), [Setting your project's permissions](/sonarqube-cloud/managing-your-projects/administering-your-projects/setting-permissions.md), and [Using permission templates](/sonarqube-cloud/administering-sonarcloud/managing-organization/manage-org-projects/manage-project-permissions/templates.md).

If you're rolling out SSO with Okta, Microsoft Entra ID, or another SAML-compatible identity provider, the SSO assistant guides you through the provider-specific configuration.

## Roll out SonarQube for IDE and AI tooling

Make sure developers can reach `sonarcloud.io` or `sonarqube.us`, depending on your hosted region.

For local analysis and issue remediation, install SonarQube for IDE in the supported IDEs and bind projects with [SonarQube for IDE](/sonarqube-cloud/analyzing-source-code/connected-mode.md). Connected mode lets SonarQube for IDE use the quality profiles, rule selections, file exclusions, and issue states configured in SonarQube Cloud.

* [VS Code](https://docs.sonarsource.com/sonarqube-for-vs-code/)
* [IntelliJ](https://docs.sonarsource.com/sonarqube-for-intellij/)
* [Visual Studio](https://docs.sonarsource.com/sonarqube-for-visual-studio/)
* [Eclipse](https://docs.sonarsource.com/sonarqube-for-eclipse/)

If your organization manages VS Code extensions through a [VS Code Private Marketplace](https://code.visualstudio.com/blogs/2025/11/18/PrivateMarketplace), make SonarQube for VS Code available through that private catalog before onboarding developers. Developers in managed environments may not be able to install the extension from the public Visual Studio Marketplace.

If your teams use AI-assisted development, you can also roll out the [https://docs.sonarsource.com/sonarqube-developer-tools/sonarqube-mcp-server/about-the-mcp-server](https://docs.sonarsource.com/sonarqube-developer-tools/sonarqube-mcp-server/about-the-mcp-server "mention"):

* Use SonarQube Cloud's embedded MCP server for the simplest setup.
* Run a local MCP server via Docker when you need local filesystem access or Sonar Vortex context and Sonar Vortex analysis tooling.
* If you use the US region, review the US-specific MCP configuration notes on the MCP server page before rollout.

## Review trust and compliance resources

Review the [Trust Center](https://trust.sonarsource.com/) for security attestations and SaaS security documentation. For ongoing enterprise administration after setup, the [Getting started with Enterprise](/sonarqube-cloud/getting-started-with-enterprise.md) section is the best next stop.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.sonarsource.com/sonarqube-cloud/quickstart-guides/quickstart-guide-enterprises.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.