{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
        "slug": "dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/"
        },
        "title": "Keep managed Service Fabric NSG overrides inside the supported priority band",
        "summary": "Which automatically created Service Fabric network rules can a custom NSG rule override?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:28:16+00:00",
        "modified_at": "2026-09-10T01:20:46+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 239,
        "potentially_affected": "Azure Service Fabric managed clusters with custom network security rules.",
        "dse_recommendation": "DSE recommends classifying a proposed exception as an override of an optional rule or a conflict with required provider access.",
        "primary_source": {
            "name": "Configure network settings for Service Fabric managed clusters - Azure Service Fabric | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-cluster-networking",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Service Fabric managed clusters reserve NSG priorities 0–999 for essential functionality and prohibit custom rules below 1000. Custom rules belong in priorities 1000–3000 and can override the optional rules placed at 3001–4000. The provider-access rule for the cluster client and HTTP gateway ports is always created and cannot be overridden. <a href=\"https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-cluster-networking\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this distinction when reviewing the managed cluster&#8217;s networkSecurityRules configuration. Identify the actual rule being challenged before selecting a priority. This article addresses the managed service&#8217;s rule-ownership boundary, not a general Windows Firewall precedence policy or permission to open an application port.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends classifying a proposed exception as an override of an optional rule or a conflict with required provider access. Record the target rule, traffic direction, ports and intended scope. If the design assumes that a custom deny can suppress the provider&#8217;s mandatory gateway rule, return that assumption to the architecture owner instead of trying increasingly aggressive priority values. Keep application access requests separate from service-management requirements.</p>\n<h2>Verification</h2>\n<p>Review the deployed effective rules against the proposed configuration in a controlled cluster. Confirm that the custom rule falls within the supported band and affects only the optional traffic being changed. Check both the intended allowed or denied application path and continued management access. Preserve the observed rule identifiers and priorities with the change record; the presence of a custom rule alone does not show which traffic it controls.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-cluster-networking\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>. Source retrieved September 9, 2026.</p>",
        "content_text": "Source facts\nService Fabric managed clusters reserve NSG priorities 0–999 for essential functionality and prohibit custom rules below 1000. Custom rules belong in priorities 1000–3000 and can override the optional rules placed at 3001–4000. The provider-access rule for the cluster client and HTTP gateway ports is always created and cannot be overridden. Microsoft Learn.\nApplicability\nUse this distinction when reviewing the managed cluster’s networkSecurityRules configuration. Identify the actual rule being challenged before selecting a priority. This article addresses the managed service’s rule-ownership boundary, not a general Windows Firewall precedence policy or permission to open an application port.\nDSE recommendation\nDSE recommends classifying a proposed exception as an override of an optional rule or a conflict with required provider access. Record the target rule, traffic direction, ports and intended scope. If the design assumes that a custom deny can suppress the provider’s mandatory gateway rule, return that assumption to the architecture owner instead of trying increasingly aggressive priority values. Keep application access requests separate from service-management requirements.\nVerification\nReview the deployed effective rules against the proposed configuration in a controlled cluster. Confirm that the custom rule falls within the supported band and affects only the optional traffic being changed. Check both the intended allowed or denied application path and continued management access. Preserve the observed rule identifiers and priorities with the change record; the presence of a custom rule alone does not show which traffic it controls.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.",
        "content_markdown": "## Source facts\n\nService Fabric managed clusters reserve NSG priorities 0–999 for essential functionality and prohibit custom rules below 1000. Custom rules belong in priorities 1000–3000 and can override the optional rules placed at 3001–4000. The provider-access rule for the cluster client and HTTP gateway ports is always created and cannot be overridden. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-cluster-networking).\n\n## Applicability\n\nUse this distinction when reviewing the managed cluster’s networkSecurityRules configuration. Identify the actual rule being challenged before selecting a priority. This article addresses the managed service’s rule-ownership boundary, not a general Windows Firewall precedence policy or permission to open an application port.\n\n## DSE recommendation\n\nDSE recommends classifying a proposed exception as an override of an optional rule or a conflict with required provider access. Record the target rule, traffic direction, ports and intended scope. If the design assumes that a custom deny can suppress the provider’s mandatory gateway rule, return that assumption to the architecture owner instead of trying increasingly aggressive priority values. Keep application access requests separate from service-management requirements.\n\n## Verification\n\nReview the deployed effective rules against the proposed configuration in a controlled cluster. Confirm that the custom rule falls within the supported band and affects only the optional traffic being changed. Check both the intended allowed or denied application path and continued management access. Preserve the observed rule identifiers and priorities with the change record; the presence of a custom rule alone does not show which traffic it controls.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-cluster-networking). Source retrieved September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Keep managed Service Fabric NSG overrides inside the supported priority band",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/",
                "headline": "Keep managed Service Fabric NSG overrides inside the supported priority band",
                "description": "Which automatically created Service Fabric network rules can a custom NSG rule override?",
                "abstract": "Which automatically created Service Fabric network rules can a custom NSG rule override?",
                "articleBody": "Source facts\nService Fabric managed clusters reserve NSG priorities 0–999 for essential functionality and prohibit custom rules below 1000. Custom rules belong in priorities 1000–3000 and can override the optional rules placed at 3001–4000. The provider-access rule for the cluster client and HTTP gateway ports is always created and cannot be overridden. Microsoft Learn.\nApplicability\nUse this distinction when reviewing the managed cluster’s networkSecurityRules configuration. Identify the actual rule being challenged before selecting a priority. This article addresses the managed service’s rule-ownership boundary, not a general Windows Firewall precedence policy or permission to open an application port.\nDSE recommendation\nDSE recommends classifying a proposed exception as an override of an optional rule or a conflict with required provider access. Record the target rule, traffic direction, ports and intended scope. If the design assumes that a custom deny can suppress the provider’s mandatory gateway rule, return that assumption to the architecture owner instead of trying increasingly aggressive priority values. Keep application access requests separate from service-management requirements.\nVerification\nReview the deployed effective rules against the proposed configuration in a controlled cluster. Confirm that the custom rule falls within the supported band and affects only the optional traffic being changed. Check both the intended allowed or denied application path and continued management access. Preserve the observed rule identifiers and priorities with the change record; the presence of a custom rule alone does not show which traffic it controls.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.",
                "datePublished": "2026-09-10T00:28:16+00:00",
                "dateModified": "2026-09-10T01:20:46+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-220-keep-managed-service-fabric-nsg-overrides-inside-the-supported-priority-band/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep managed Service Fabric NSG overrides inside the supported priority band"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 239,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure network settings for Service Fabric managed clusters - Azure Service Fabric | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-cluster-networking"
                }
            }
        ]
    }
}