title: Prevent check-ins and restrict merges for TFS branch
body: <p>In my environment we have Dev, Main and Production branches. We also have Business and Architecture teams. What I would like to achieve is the following:</p>
  
  <ol>
  <li>Both teams can Contribute to Dev</li>
  <li>The Business team can only read Main and Production</li>
  <li>The Architecture team can only merge into Main and Production</li>
  </ol>
  
  <p>Currently, both teams are members of the Contributors group on the Team Project.</p>
  
  <hr>
  
  <p>Final Solution:</p>
  
  <ol>
  <li>Created a Group called Promo Officers at the collection level</li>
  <li>Added the Architecture team to the new group</li>
  <li>Added the Promo group to the permissions at the collection level (in Source Control Explorer right-click the collection, select properties and click permissions</li>
  <li>Gave Promo Officers Read, Check Out, Check In, Label, Admin Labels, Merge and Manage Branch permissions</li>
  <li>Turned off Inherit Security for the Main and Production branches.</li>
  <li>Set the permissions for Contributors to just Read.</li>
  </ol>
  
  <p>NB: You can't deny the unwanted permissions for Contributors because if a user is both in Contributors and Promo Officers, then the deny takes precedence and they won't have the correct permissions. Secondly, I wasn't able to achieve my goal of only allowing merges to Main and Production as you need Check In and Check out permissions to do merges.</p>