It happens. And the reason here is extremely easy and straightforward: if you have any permission on your AAD application for SonarQube which you don’t need you will be denied access 
The documentation was updated in June but this error came out recently on an old instance set up before then.