We have branch policies set up in VSTS to prevent pull requests being merged into master unless a build passes and work items are linked. However, I can't work out how to prevent developers pushing directly to master. Setting the "Contribute" permission to Deny does not allow pull requests to be merged.

All developers should be allowed to merge PRs into master but none should be permitted to push directly to master. Is this possible?