Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

PolicyForge

Free#22 of 25 in Infrastructure Policy as Code Tools

PolicyForge: A broad, Azure-oriented IaC scanner with Rego evaluation and self-hosted governance views. Ranked #22 of 25 in Infrastructure Policy as Code Tools by our editors (7.2/10); pricing: Open source; best for azure-focused open-source IaC governance.

7.2/10Editor score
Visit PolicyForge
PolicyForge7.2 Visit PolicyForge

At a glance

  • Editor score
    7.2 / 10
  • Pricing
    Open source
  • Best for
    Azure-focused open-source IaC governance
  • Paid from
    Free
  • Facts checked
    20 Sep 2026
PolicyForge screenshot

  • Where it wins

    • Parses Terraform, Bicep, Kubernetes manifests, and Helm charts
    • Produces SARIF, JSON, table, SBOM, and SLSA provenance output
    • Connects with GitHub Actions, Azure DevOps, and Azure Resource Graph

  • Where it doesn't

    • The project is identified as version 0.1
    • Enterprise governance features require a self-hosted portal
    • Policy testing and admission control are not part of its described capabilities

Our verdict on PolicyForge

PolicyForge is an open-source policy-as-code scanner for teams governing infrastructure-as-code across Terraform, Bicep, Kubernetes manifests, and Helm charts. Its CLI converts these formats into a unified resource model and evaluates OPA/Rego rules, while custom policies can be loaded from .rego files. The product is especially suited to Azure-focused engineering and compliance teams that want infrastructure scanning, reporting, and drift visibility without adopting a hosted commercial service.

Its strongest differentiator is breadth across policy inputs and output formats. PolicyForge can generate SARIF, JSON, and table results for different review and automation workflows, alongside SBOM and SLSA provenance output. Azure drift detection compares deployed state with live Azure Resource Graph state, giving Azure users a focused way to identify configuration differences. GitHub Actions and Azure DevOps integrations support CI/CD use, while the self-hosted dashboard adds audit and compliance views. OIDC and Microsoft Entra ID integrations extend the portal’s identity options.

The trade-off is scope and maturity. The repository identifies the project as version 0.1, so teams should assess whether its current implementation fits their operational requirements before standardizing on it. The self-hosted enterprise portal provides organization-wide policy management, audit logs, compliance mapping, and single sign-on, but it also keeps deployment responsibility with the adopting team. PolicyForge is a strong fit for open-source, Azure-oriented IaC governance across several manifest types. Teams prioritizing policy testing or admission control should choose an alternative with those capabilities as core features.

Your product? Our editors can test PolicyForge in depth and publish a review, labelled as paid · from $149/mo →

PolicyForge pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.
See plans on github.com

PolicyForge fact sheet

Free planNot verified
Paid fromFree
Policy languageOPA/Rego
IaC formatsTerraform, Bicep, Kubernetes manifests, Helm charts
Policy testingNot verified
Admission controlNot verified
Runtime enforcementNot verified
CI/CD integrationYes
Policy reportingYes
DeploymentCloud, Self-hosted, Browser extension
PlatformsWeb
SupportDocs
Built forSmall business, Mid-market, Enterprise (editorial estimate)
Integrations5 integrations: GitHub Actions, Azure DevOps, Azure Resource Graph, OIDC, Microsoft Entra ID
PricingOpen source
Websitegithub.com
Facts checked20 Sep 2026

PolicyForge integrations

PolicyForge lists 5 integrations on its own site.

  • GitHub Actions
  • Azure DevOps
  • Azure Resource Graph
  • OIDC
  • Microsoft Entra ID

Alternatives to PolicyForge

See all PolicyForge alternatives →

Used PolicyForge? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used PolicyForge for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — PolicyForge 7.2/10

PolicyForge is listed in our Infrastructure Policy as Code Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/policyforge/"><img src="https://www.itechguides.com/best/badge/policyforge.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update