Azure DevOps branch policies are repository rules that protect important branches such as main. They can require pull requests, minimum reviewer counts, resolved comments, linked work items, successful build validation, and external status checks before a change is merged.
The policies that carry the most security value
- Require pull requests so protected branches cannot be changed through ordinary direct pushes.
- Require reviewers and prevent the most sensitive changes from being self-approved.
- Run build validation automatically when the source branch changes.
- Use required status checks for security decisions produced outside the build itself.
- Restrict bypass permissions and review every bypass as a privileged event.
Build validation is necessary, but not sufficient
A successful build proves that one pipeline completed. It does not prove that every repository has the right validation policy, that the security task still exists, or that the threshold is consistent across projects. Estate-level governance needs to observe the policies and the pipelines behind them.
