Your team uses an Azure Repos Git repository and developers commit directly to the default branch. You must protect the default branch so that new changes are built in feature branches first, each merge is reviewed and approved by at least one release manager, and changes are merged into the default branch using pull requests. What should you configure in Azure Repos?

Configuring branch policies for the default branch in Azure Repos is the correct approach. Branch policies enforce quality gates, such as requiring pull requests for all changes, mandating successful builds, and specifying a minimum number of reviewers (like release managers) for approval before merging. This directly addresses all requirements: new changes in feature branches, review and approval by release managers, and merging via pull requests. "Services in Project Settings" and "Deployment pools in Project Settings" are unrelated to branch protection; they manage external service connections and deployment targets, respectively. "Branch security of the default branch" controls permissions (who can push, delete, etc.) but doesn't enforce the workflow requirements like pull requests or reviewer approvals.