Question

Is there a way to deny the force push permission by default, only on the main branch, for any existing and new repos within a project, while still allowing it for all other branches?

Background

My team uses Azure DevOps to host our various git repos. Our typical workflow is to create feature branches from main, make changes, then commit them to main via pull requests. We want to have the freedom to force push to and delete feature branches we create.

In some cases, we find it useful to make direct commits to main instead. By convention, this is limited to minor changes with little impact, like fixing a typo in a readme. These needs are served by simple contribute permissions to allow a normal, non-force push.

Currently, we inherit force push permissions to all our repos from our group at the project level. This works well, except it also gives us force push permissions to main.

We’d like to deny force push permissions to main in all repos, current and future, by default to prevent anyone from accidentally erasing history from main.

What I’ve found so far

I believe we could achieve this for all current repos by setting the permission to deny explicitly on the main branch in each repo. However, we have a lot of repos and create new ones frequently. Having to set this for each new repo is impractical.

The general approach to this seems to be to make main a “protected” branch by enabling one or more policies. Doing so forces any changes to main to be made via pull requests, though, which would prevent us from making normal, non-force push changes directly to main.