Azure DevOps Services and Server · REST API, Azure CLI and automation · Checked October 24, 2026

Azure DevOps: "This pull request requires an explicit override to bypass policies that aren't currently passing."

The pull request and the token are both fine. A policy on the target branch has not passed yet, such as required reviewers or a build, and completing now would skip it. Azure DevOps refuses the completion with HTTP 403 unless the request explicitly asks to bypass the policies and the account is allowed to.

The whole answer

As public reports from 2019 to May 2026 quote it, from the REST API, the Azure CLI and tools that merge pull requests on their own:

HTTP/1.1 403 Forbidden

{"$id":"1","innerException":null,"message":"This pull request requires an explicit override to bypass policies that aren't currently passing.","typeName":"Microsoft.TeamFoundation.Git.Server.GitPullRequestUpdateRejectedByPolicyException, Microsoft.TeamFoundation.Git.Server","typeKey":"GitPullRequestUpdateRejectedByPolicyException","errorCode":0,"eventId":3000}

The Azure CLI prints the message alone, for example after az repos pr complete (2019).
The same exception also comes with The pull request needs to be approved by all required reviewers before it can be completed. (a review bot's automatic merge, May 2026).
It also comes when the merge type is one the branch's merge-type policy does not allow: a tool that could not send the semi-linear merge, the only type a branch allowed, was refused on every completion (May 2026).
It is a 403, but a new token does not help. Tools match it on GitPullRequestUpdateRejectedByPolicyException, which stays the same in every language of the message.

See which policy has not passed

In the web: the pull request's Overview lists the required and optional checks with their state: reviewers, builds, linked work items, comment resolution, merge types.
With the REST API: GET …/<project>/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/<project id>/<pull request id>&api-version=7.1-preview.1 returns each policy with a status such as approved, running, queued or rejected.

What to do

Get the policy to pass: ask the required reviewers to approve, queue a failed build again, link a work item or resolve the comments, whatever the list shows.
Let it complete by itself: set auto-complete, and Azure DevOps completes the pull request once every required policy passes. In the web, Set auto-complete; with the Azure CLI, az repos pr update --id <id> --auto-complete true, which can also wait on optional policies (auto-complete and optional policies).
Choose an allowed merge type: if the branch limits merge types, complete with one it allows (merge types and Limit merge types).
Override, if you may: in the web, tick Override branch policies and enable merge when completing; with the Azure CLI, az repos pr update --id <id> --status completed --bypass-policy true --bypass-policy-reason "<reason>". Either needs the repository permission Bypass policies when completing pull requests (Microsoft's page on completing pull requests calls it Exempt from policy enforcement). (Microsoft: complete a pull request)
In a script or a bot, send "bypassPolicy": true and a bypassReason inside completionOptions of the same request that sets "status": "completed", and give the identity of the token or the pipeline that permission; without it, the answer stays 403. The Azure CLI once kept these options on the pull request but did not send them with the completion, and got this message until a fix in 2019.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, reads the organization, project and repository from your git remote and lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. It shows the branch policies of a pull request with their state, queues a failed build again, and when a required policy has not passed, its Complete dialog offers auto-complete first. From version 1.0.41, when Azure DevOps still refuses the completion this way, it says that a branch policy refused it, not the token, and points to auto-complete and to the bypass permission. The review inbox is free; voting, commenting, completing and creating are Pro, with a 30-day trial.

Get it on JetBrains Marketplace

Azure DevOps is a trademark of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: TF401181: it was completed or abandoned · TF401027: a missing Git permission · TF402455: pushes to this branch are not permitted · why an approval does not count · 日本語