VSTS – prevent push to master but allow PR merge

Branch policies already do exactly what you’re saying. When a branch policy is in place, PRs are required.

Make sure your developers don’t have the “Exempt From Policy Enforcement” permission.