title: Only allow users under a certain AD Group to approve Pull Requests on Azure DevOps
body: <p>On my organisation we use Azure DevOps and we have a repository where we want developers to be able to create pull requests with changes to it, but only develpers belonging to certain AD group to be able to approve them. What's the best way to achieve this in Azure DevOps?</p>
  
  <p>According to <a href="https://docs.microsoft.com/en-us/azure/devops/organizations/security/permissions?view=azure-devops&amp;tabs=preview-page#git-repository-object-level" rel="nofollow noreferrer">Microsoft Documentation</a> there is a permission called "Contribute to pull requests  " which allows "Can create, comment on, and vote on pull requests." However, disabling this would mean that people cannot create pull requests. I want them to be able to create the pull request, just not able to approve them and complete them.</p>