Analysis report rejected at submission when scanner token lacks Execute Analysis

A scanner run can complete local analysis yet import no issues because the server rejects the analysis report before it reaches the Compute Engine. The goal is to understand exactly which authorization gate causes that rejection and how it differs from anonymous UI access.

The failure occurs on the server-side report submission path behind the Web API, not in the language analyzers. A common assumption is that setting sonar.forceAuthentication=false allows credential-less analysis, but that setting only governs anonymous UI browsing; it does not grant permission to submit an analysis. Newer scanner lines favor sonar.token over the older sonar.login/sonar.password pair, and token expiry or rotation can silently break CI pipelines. Behavior varies across SonarQube versions and scanner editions, so defaults should be confirmed on a disposable instance.

Does sonar.forceAuthentication=false ever permit a scanner to submit an analysis report without a token, or is Execute Analysis strictly required regardless of that setting? When a token is present but submission still fails, is the authoritative rejection recorded in ce.log rather than only the scanner console? For CI pipelines, what is the operational trade-off between granting Execute Analysis to a shared service account versus issuing project-scoped analysis tokens with respect to blast radius and silent rotation failures?