We have branch policies set up in VSTS to prevent pull requests being merged into master unless a build passes and work items are linked. However, I can't work out how to prevent developers pushing directly to master. Setting the "Contribute" permission to Deny does not allow pull requests to be merged.
All developers should be allowed to merge PRs into master but none should be permitted to push directly to master. Is this possible?
Branch policies already do exactly what you're saying. When a branch policy is in place, PRs are required.
Make sure your developers don't have the "Exempt From Policy Enforcement" permission.