TFS permissions, default deny, specific allow

Question

Recently we switched from source control from TFS to Git in TFS. We want to protect our master branch from accidentally checks in. So I want to deny all "regular" developers from contributing to this branch and a separate group of people who can contribute. This can be done by tfs groups, but the problem is that deny wins over allows. So I cant set default deny. So when a new person arrives and I forget him to put in the "regular" developers group he will be able to checkin. Is there another way to do this?

Answer 1

"Not Set" permission means "implicitly deny" -- it will be denied by default, unless explicitly allowed.

Set your groups up without explicit deny permissions and then anyone can be a member of any set of groups, but only those who are members of groups with Allow permissions will be able to contribute.

Answer 2

Just as you said " deny wins over allows ". So, you can not add the same users to multiple groups. You need to add them to separated groups, that means one user only in one group.

For example user1, user2 in regular group; user3,user4 in a separate group, then user3, user4 can contribute.

Another workaround is setting the Branch Policies for master branch to force code review . Thus the changes only can be checked in when the Admin or other specific user approved the changes.