// tools/policy-tester

Azure Policy tester

Paste a policy definition and a resource's JSON. The tool evaluates the if conditions the way Azure Policy does, tells you whether the resource would be denied, audited or changed, shows which condition decided, and explains the whole rule in plain English.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Policy definition (JSON)

load file

Resource (JSON)

load file

Parameter values (JSON, optional)

What it supports

Logical operators allOf, anyOf and not, nested to any depth.
Every condition: equals, notEquals, like, notLike, match, matchInsensitively, notMatch, notMatchInsensitively, contains, notContains, in, notIn, containsKey, notContainsKey, less, lessOrEquals, greater, greaterOrEquals and exists.
Fields: name, fullName, type, kind, location, id, identity.type, tags in every supported form, and property aliases, including [*] array aliases and count.
Template functions in values: parameters(), field(), concat(), toLower(), toUpper(), if(), equals(), contains(), empty() and length(). Anything else is shown as "can't evaluate here".

Aliases are matched to the resource's properties by name, which works for the vast majority of aliases but isn't Azure's alias catalogue. auditIfNotExists and deployIfNotExists also check related resources, which this tool can't see. Before assigning a policy, test it with enforcement mode set to doNotEnforce.

Sources