Policy Definitions

Author your own custom Azure policies with Clophi's Smart Policy Builder assisted by inline alias paths and integrated resource documentation. Browse Azure's Built-in and custom policy definitions in one place.

Overview

Create policy Policy definition creation is handled by Clophi's Policy Builder which is a visual rule editor backed by Azure resource schemas, alias paths, and property documentation. You can use it to create a policy from scratch.
Modify policyThe Enterprise Policy Center fetches every policy definition available in your environment, both Custom and Built-in and they are listed in the policy definitions dashboard. From here you can access existing definitions, import any of them into the policy builder for further customization.

Creating a Policy Definition

To start creating policy definition, click Create Policy Definition from the Enterprise Policy Center.

Targeting a resource

Select the Azure resource type your policy will target. Clophi loads the corresponding resource form, which you can use to get alias path and resource property detail for that resource type.

The If section of the policy builder with condition rows — Choose a resource that your policy will target. You can also combine multiple resources in a single policy by choosing different resources successively.

Building the Policy Rule

Navigate to the If section on the right tab to begin defining your policy rule. Policy rule is composed of at least one or more conditions and/or logical groups that determine when the policy will apply. Click the + button to add a new condition or logical group.

Conditions and operators

When you add a new field, Clophi initializes it with a default equals operator. To change it, click on equals and select from the list of available conditions — notEquals, contains, in, exists, and so on.

Smart alias path auto-fill

The resource form assists you in handling alias paths so you don't have to memorize or look them up!
First you click on a resource property on the resource form on left side of the page.

Then you click on the condition on the if section on right-hand tab. This will populate the alias and the chosen (or entered) value within the clicked condition.

The referenced property's alias path is automatically inserted into the field input. The value you entered (or selected) is also pasted into the condition value. The available operators for that field are also re-populated based on the type of the inserted alias at this stage.

Integrated documentation

Every property in the resource form is linked to its official Azure documentation. Click any field to load the relevant reference content into the right-hand tab.

Clicking a property in the resource form loads its Azure documentation in the right tab — Documentation for the selected field is loaded directly into the right tab.

Defining the Effect

In the Then section, choose the policy effect. This is the action Azure takes when the rule matches. Effects determine whether matching resources are denied, audited, modified, or deployed against, and follow the Azure Policy effect specification.

The Then section of the policy builder showing effect selection — Select a policy effect to determine how Azure responds to matching resources.

Parameters and Metadata

Open the Policy section of the right tab to define parameters and metadata for your definition.

Finalizing the Definition

Once your rule, effect, parameters, and metadata are in place, finalize the definition:

Enter a name in the Name input.
Select the target scopes from the Definition Location input. You can choose multiple subscriptions or management groups.

Validate, export, or deploy

The policy definition you work on can be validated against Azure via Validate button while you work it. Validation is conducted by Clophi and your environment is untouched during this validation. It can also be downloaded as Policy-as-Code in Terraform, Bicep, or ARM Template (parameterized or non-parameterized), or created directly by Clophi across all selected scopes in a single operation.

The finalize panel showing name, definition location, and action buttons — Validate, download, or create the policy definition once finalized.

Import and Modify existing Definitions

Clophi imports all of your tenant's existing Custom policy definitions. Together with around ~5000 Azure Built-in definitions, you can use them as a foundation to create new policies. You can customize them however you like, following the same processes described above.