Azure DevOps Services and Server · git push and REST API · Checked October 24, 2026

Azure DevOps: "TF401027: You need the Git 'GenericContribute' permission to perform this action."

TF401027 names one Git permission that the identity in the message does not have on the repository or branch. It is a permission in Azure DevOps, not your token's scope and not your git credentials: signing in again or making a new token does not change it. A project administrator grants it in Project settings → Repositories → Security. In a pipeline, the identity is the build service account.

The whole answer

As public reports from 2020 to October 2026 quote it, from git push (on a remote: line) and from the REST API (HTTP 403, in the message of the JSON answer):

TF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\<GUID>', scope 'repository'.

The name in quotes changes with what was refused (CreateBranch, PullRequestContribute, ForcePush…), identity is the account that lacks it, and scope is repository or branch. We have not caused this answer ourselves; the line above is the form every report we read quotes.

Which permission

The message uses Azure DevOps' internal names. On the Security page they are called (Microsoft's permissions reference):

• GenericContribute = Contribute: push commits to a branch.
• CreateBranch = Create branch: push a branch that does not exist yet.
• CreateTag = Create tag: push a tag.
• ForcePush = Force push (rewrite history, delete branches and tags).
• PullRequestContribute = Contribute to pull requests: create, comment on and vote on pull requests.
• PullRequestBypassPolicy = Bypass policies when completing pull requests.

By default (Set Git repository permissions), the project's Readers have Read and Contribute to pull requests, and Contributors also have Contribute, Create branch, Create tag and Manage notes. No group has Force push or the two Bypass permissions. So a person who gets TF401027 for GenericContribute or CreateBranch is usually only in Readers, or has a Deny from one of their groups, which overrides an Allow.

Whose permission

• A person (a name or e-mail in identity): that account, whichever token or sign-in it used.
• Build\<GUID>: a pipeline, acting as its build service account. That is <project> Build Service (<organization>) when Limit job authorization scope to current project for non-release pipelines is on, and Project Collection Build Service (<organization>) when it is off (Microsoft). By default it may read the repository but not push to it.
• scope 'branch': the refusal comes from the branch's own permissions (Repos → Branches → the branch's … menu → Branch security), which can deny what the repository allows.

Grant it

1. As a project administrator (or anyone with Manage permissions on the repository), open Project settings → Repositories.
2. Select All Repositories → Security for every repository in the project, or the repository and then Security for one.
3. Find the user, group or build service account from the message, and set the permission to Allow. On Azure DevOps Services the change is saved at once; on Azure DevOps Server select Save changes.
4. If it is already Allow and still refused, look for a Deny on one of the account's groups or on the branch.

For a pipeline that pushes, Microsoft's Run Git commands in a script picks <project name> Build Service (<organization>) under Users and allows Create branch, Contribute, Read and Create tag, with persistCredentials: true on the checkout step so that git push uses the job's token:

steps:
- checkout: self
  persistCredentials: true

A refusal for a branch with required policies is a different message, TF402455: push to a new branch and open a pull request.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. Voting and commenting use your account's Contribute to pull requests, which Readers and Contributors have by default. From version 1.0.34, when Azure DevOps refuses a change with TF401027, the plugin names the missing permission as the Security page shows it and where to grant it, instead of asking for another token. The review inbox is free; voting, commenting and completing are Pro, with a 30-day trial.

Get it on JetBrains Marketplace

Azure DevOps is a trademark of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: TF401019: the repository does not exist or you do not have permissions · Azure DevOps plugins for IntelliJ IDEA 2025.2 and later · 日本語