For PHPMD (just as for PHP CodeSniffer, for example) you will have to specify a separate exclude pattern. You can use PHPMD's --exclude
parameter for that.
Took me a while to figure it out, but you can set PHPMD's command line parameters with the following setting in your sonar-project.properties
file:
sonar.phpPmd.argumentLine=--exclude libraries/externals