Azure Repos · git push · Checked October 24, 2026

Azure DevOps: "TF402455: Pushes to this branch are not permitted; you must use a pull request to update this branch."

The branch has a required branch policy, so Azure Repos takes changes to it only through pull requests. The push was refused, the branch on the server did not change, and your commits are still in your local branch. Put them on a new branch, push that, and open a pull request into this one.

The whole message

git prints the refusal like this. The text in brackets comes from Azure DevOps, as public bug reports from 2018 to 2023 show it; the rest is git's own.

 ! [remote rejected] main -> main (TF402455: Pushes to this branch are not permitted; you must use a pull request to update this branch.)
error: failed to push some refs to 'https://dev.azure.com/<organization>/<project>/_git/<repository>'

It is not a sign-in problem. Azure DevOps accepted who you are and refused because of the branch's policy, so a new token or password for the same account will not help.

Why Azure Repos refuses

From Microsoft's page on branch policies (Set and manage branch policies):

• You can't push directly to a branch with a required branch policy unless you have permission to bypass branch policies. Changes reach it only through pull requests.
• A branch with only optional policies still takes direct pushes.
• A branch with required policies cannot be deleted either.

Move your commits to a pull request

# 1. Put your commits on a new branch (you stay on them)
git switch -c my-change

# 2. Push the new branch
git push -u origin my-change

# 3. Set your local main back to where the server has it
git branch -f main origin/main

We ran these against a local git server that refuses pushes to main: the commits ended up on my-change on the server, and the local main matched origin/main again. Do step 3 only after step 2 succeeded. With Git older than 2.23, use git checkout -b my-change for step 1.

Then open the pull request from my-change into main:

• On the web: Repos → Pull requests → New pull request. After you push a branch, Azure Repos also offers Create a pull request on the Pull requests and Files pages, and on Azure DevOps Services the git push output can include a direct link.
• With the Azure DevOps CLI (the azure-devops extension; Azure DevOps Services only): az repos pr create --source-branch my-change --title "My change" --open. Without --target-branch, it targets the repository's default branch.

When a pipeline pushes

A pipeline that commits back to the branch, such as a version bump or a changelog, gets the same refusal. Either have it push a branch and open a pull request, or give the identity it runs as Bypass policies when pushing. Microsoft lets you grant that permission for a whole project, one repository or a single branch, and asks for caution with it, so grant it on that one branch only.

Create Azure DevOps pull requests from IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, adds Git → Create Azure DevOps Pull Request…. It opens a pull request from the branch you are on, into the repository's default branch unless you pick another, optionally as a draft. If the branch is not on Azure DevOps yet, it says so and opens the IDE's push dialog first. Creating pull requests is Pro (US$1 a month, with a 30-day free trial); the review inbox is free.

Get it on JetBrains Marketplace

Azure DevOps and Azure Repos are trademarks of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: Azure DevOps plugins for IntelliJ IDEA 2025.2 and later · 日本語