Azure Devops - how to protect main branch from delete and push

Question

We store our git in TFS - Azure Devops.

We want to protect the main branch from push and deletion. push must be done with PR.

So we added a branch policy "Require a minimum number of reviewers".

The problem: users can still push to the branch.

So we updated the policy for "Bypass policies when pushing" and "Force push (rewrite history, delete branches and tags)" to "Deny".

But now the users cannot delete other branches..

Any idea how can we protect only the Main branch from deletion and push ?

Answer 1

Based on your description, it seemed that you had denied Force push (rewrite history, delete branches and tags) security settings on the repository level, so that all other branches were unable to be deleted as well.

Please check the security permission Force push (rewrite history, delete branches and tags) in All repositories and one affected repository for the users/groups. You may try and set the permission of Force push (rewrite history, delete branches and tags) in your repository Security tab back to Allow/Not Set for the users/groups and only adopt branch security restriction on the branch level.

Kindly refer to the security settings on the main branch like below. Thus, other branches will not be affected by the settings of the main branch and they could be still deleted or pushed.