Your team uses Azure Repos with a Git repository named 'payments-core'. Release engineers create annotated tags such as 'v2.4.0' to mark production builds, and these tags must be immutable for audit compliance. Recently, a developer accidentally deleted the tag 'v2.3.0' and pushed a new tag with the same name pointing to a different commit. You must prevent any user other than the 'Release Managers' group from creating, editing, or deleting tags, while still allowing all contributors to push commits to branches. What should you configure?