title: TFS Contribute permission for Git branch
body: <p>We have on-premise Team Foundation Server (v14.114.26403.0). I am in the process of trying to lock down our dev+master branches to encourage devs to create feature branches and do pull requests to dev. As part of this I have set the Contribute permission to "Deny" for all access groups on dev branch except Project and Build Administrators groups.</p>
  
  <p>Unfortunately once I do this members of the administrator groups cannot complete the pull requests, it looks like they don't have permission either, even though they explicitly have "Allow".</p>
  
  <p>They get the following error:</p>
  
  <blockquote>
    <p>TF401027: Your account lacks the permission(s)
    required for the operation you are attempting. You need to have
    'GenericContribute'. Please contact your administrator.</p>
  </blockquote>
  
  <p>I also get this error until I restore the contribute permissions to the other groups.</p>
  
  <p>Anyone know why this is happening? Or how to resolve? All I can think of is that the users in administrator groups are also in contributors so perhaps the "Deny" from their membership to Contributor group is overriding their "Allow" from admin?</p>