You can set a branch filter on the Continuous deployment Trigger, See below:

Click the highlighted trigger icon in the Artifacts section to open the trigger panel--> Enabled Continuous deployment Trigger--> Set the branch filter to only include master branch.

When you set your release pipeline Continuous deployment Trigger as above. Only the artifacts generated from master branch can trigger the release pipeline.

You can also set an artifact filter for each stage to make sure only artifacts come from a specific branch can be deployed to this stage. See below:

You can check out this document to learn more about classic CD pipeline.

YAML Pipelines

If you're using a YAML-based pipeline, you can use the Checks + Approval Gates feature to add a branch policy check.

1. Create an Environment for each deployment environment
2. Structure your YAML pipeline to use a Deployment Job that specifies the Environment

stages:
- stage: build
- stage: dev
- stage: test
- stage: preprod
- stage: prod

You can put conditions on the stages to ensure the branch conditions are met.

- stage: production
  dependsOn: preprod
  condition: |
    and(
      succeeded('preprod'),
      or(
        eq(variables['Build.SourceBranch'], 'refs/heads/main'),
        startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'),
        startsWith(variables['Build.SourceBranch'], 'refs/heads/hotfix/')
      )         
    )

3. Ensure each stage that performs the deployment activities has a Deployment Job:

- deployment: deploy
  displayName: 'Deploy'
  environment: 'Production'
  strategy:
    runonce:
      deploy:
        steps:
        - pwsh: Write-Host 'Deployment Steps go here!'

4. In your Production Environment, add the Branch Control check:

   

Classic Release Pipelines

If you're using a Classic Release pipeline, you can add artifact filters to prevent the pipeline from being queued, but these do not enforce that the Stage cannot be run manually or override these filters.

If you truly want to prevent the release, even if someone manually overrides the artifact filter, you could fail the build by checking that it is the correct branch in a script.

$currentBranch = "$(Release.Artifacts.MyAlias.SourceBranch)" 
if ( $currentBranch -ne "refs/heads/main" )
{
    Write-Host "##vso[task.logissue type=error]This release must originate from the main branch. Current branch: $currentBranch"
    Exit 1
}

@paddingtonMike,

This is a core feature of ADO Release Pipelines, you can complete this many ways; however, the most common is by modifying the source of your artifact.

I highly recommend that you invest some time in learning ADO Release Pipelines. Here is a great resource to get started with:

Learn - Create Release Pipeline

I don't know of a way to prevent a deployment from being created from a non-main branch. That said, Levi's answer will prevent a release from being created or deployed automatically. In addition to that, you can set up required reviewers on deployments which will guarantee no release can go out without the approval of a person who is authorized to deploy.

(Specific section of the link Levi shared) https://docs.microsoft.com/en-us/azure/devops/pipelines/release/define-multistage-release-process?view=azure-devops#add-pre-deployment-approvals