PolicyForge review
A broad, Azure-oriented IaC scanner with Rego evaluation and self-hosted governance views.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
PolicyForge is an open-source policy-as-code scanner for teams governing infrastructure-as-code across Terraform, Bicep, Kubernetes manifests, and Helm charts. Its CLI converts these formats into a unified resource model and evaluates OPA/Rego rules, while custom policies can be loaded from .rego files. The product is especially suited to Azure-focused engineering and compliance teams that want infrastructure scanning, reporting, and drift visibility without adopting a hosted commercial service.
Its strongest differentiator is breadth across policy inputs and output formats. PolicyForge can generate SARIF, JSON, and table results for different review and automation workflows, alongside SBOM and SLSA provenance output. Azure drift detection compares deployed state with live Azure Resource Graph state, giving Azure users a focused way to identify configuration differences. GitHub Actions and Azure DevOps integrations support CI/CD use, while the self-hosted dashboard adds audit and compliance views. OIDC and Microsoft Entra ID integrations extend the portal’s identity options.
The trade-off is scope and maturity. The repository identifies the project as version 0.1, so teams should assess whether its current implementation fits their operational requirements before standardizing on it. The self-hosted enterprise portal provides organization-wide policy management, audit logs, compliance mapping, and single sign-on, but it also keeps deployment responsibility with the adopting team. PolicyForge is a strong fit for open-source, Azure-oriented IaC governance across several manifest types. Teams prioritizing policy testing or admission control should choose an alternative with those capabilities as core features.
PolicyForge pros and cons
- Where it wins
- Parses Terraform, Bicep, Kubernetes manifests, and Helm charts
- Produces SARIF, JSON, table, SBOM, and SLSA provenance output
- Connects with GitHub Actions, Azure DevOps, and Azure Resource Graph
- Where it doesn't
- The project is identified as version 0.1
- Enterprise governance features require a self-hosted portal
- Policy testing and admission control are not part of its described capabilities
PolicyForge fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update