Feature comparison table
This page lists features relevant to comparing support in the different SonarQube deployments.
For the supported languages, see Supported languages.
For more information about the features supported in the SonarQube Cloud, see Subscription plans. For more information about features supported in SonarQube Server, see the SonarQube Server documentation.
Code analysis
Branch analysis
Only main branch analysis
Only main branch analysis
Pull request analysis
Only if the target branch is the main branch
Custom quality profiles
Custom quality gates
Prioritized rules (in quality gate definition)
From Enterprise
Architecture
Enterprise architecture (open beta)
From Enterprise
Enterprise only
AI code analysis
AI Code Assurance (Code quality assurance for AI generated code)
Sonar Vortex (equips coding agents to write and verify code that fits your project; requires a separate subscription)
From Enterprise
Hunter Agent (AI agent that finds broken access control, business logic, and authentication flaws; requires a separate subscription)
From Enterprise
Enterprise only
Security analysis
Injection vulnerabilities detection
Injection vulnerabilities detection: security engine custom configuration
From Enterprise
Secret detection: Custom secret patterns
From Enterprise
Advanced security analysis
Software Composition Analysis (SCA)
From Enterprise
Product
Advanced SAST (Static Application Security Testing)
From Enterprise
Product
AI-powered code remediation
AI CodeFix (AI-generated fix suggestions)
Remediation Agent (AI agent that fixes backlog and pull request issues by opening pull requests)
From Enterprise
Agentic development
SonarQube Cloud-hosted and Server-hosted MCP server
Management reporting
Portfolios
From Enterprise
Enterprise only
Dashboards
From Enterprise
Enterprise only
Security reports
From Enterprise
Enterprise only
Project PDF reports
From Enterprise
Enterprise only
Regulatory reports
From Enterprise
Applications (aggregation of multiple projects)
System security
Single Sign-On (SAML)
Enterprise only
Auto-provisioning (SCIM)
From Enterprise
Enterprise only
IP allow list restriction
Enterprise only
Audit logs
From Enterprise
Enterprise only
Maximum lifetime for tokens
From Enterprise
(Scoped Organization Tokens)
Inactive session timeout
Configurable
Not configurable (24 h)
Configurable
Not configurable (24 h)
Active session timeout
From Enterprise (configurable)
DevOps platforms: GitHub, Bitbucket Data Center, Bitbucket Cloud, GitLab, Azure DevOps
User authentication
(with automatic provisioning for GitHub and GitLab)
Security issues report in GitHub and Gitlab
Quality gate status report on pull requests; Preventing merge when quality gate fails
Monorepo integration
From Enterprise
Multiple DevOps Platform instances
From Enterprise
Integration with external applications
Jira Cloud
Slack
JFrog Evidence Collection
From Enterprise
Enterprise only
Webhooks
Last updated
Was this helpful?