# Account for zonal upgrade sequencing in Service Fabric timeouts

> Hierarchical and Parallel zonal modes group upgrade domains differently; faster cross-zone progression is not equivalent to zone-by-zone rollout.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-291-account-for-zonal-upgrade-sequencing-in-service-fabric-timeouts/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:05+00:00
- Modified: 2026-09-10T01:23:49+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Hierarchical and Parallel zonal modes group upgrade domains differently; faster cross-zone progression is not equivalent to zone-by-zone rollout.

## Potentially affected

Azure Service Fabric node types configured to span multiple Availability Zones.

## DSE recommendation

Review upgrade-domain grouping and timeout budgets together, retaining zone-by-zone progression where the design requires it.

## Article

## Source facts

For a multi-zone Service Fabric node type, sfZonalUpgradeMode set to Hierarchical, also used when the setting is omitted, groups nodes into up to fifteen upgrade domains: five in each of three zones. It completes one zone’s domains before moving to the next.

Parallel mode instead uses five upgrade domains across zones and upgrades them without preserving that zonal sequence. Microsoft discourages it for safe-deployment reasons. The guidance also warns that hierarchical grouping slows cluster and application deployments, requiring timeout-policy review.

sfZonalUpgradeMode cannot be changed once a multi-zone node type exists. It controls Service Fabric application and code upgrades, not the underlying scale-set upgrades; vmssZonalUpgradeMode governs the latter separately. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-cross-availability-zones).

## Applicability

Confirm the existing multi-zone configuration and supported cluster prerequisites. For a new design, select the grouping before creation; this article does not provide a migration procedure or authorize changing an immutable property.

## DSE recommendation

DSE recommends documenting the configured upgrade-domain progression before reviewing timeout budgets. Compare application health gates and cluster code-upgrade timing with that progression. Do not propose Parallel merely to hide a timeout; assess any different design through a supported migration plan. Set an approved time budget and stopping conditions based on the intended model and a representative test.

## Verification

Observe a controlled upgrade and retain domain order, zone membership, health decisions and elapsed time. Check that the expected sequence actually occurred, not just that the final version was reached. Investigate a timeout by locating the delayed domain and health gate. Approve a revised budget only after it supports the intended progression without discarding the checks that make the rollout acceptable.

## Official references

[Microsoft Learn: Deploy a cluster across Availability Zones](https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-cross-availability-zones). Source retrieved September 9, 2026.

## Primary reference

- Name: Deploy a cluster across Availability Zones - Azure Service Fabric | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-cross-availability-zones
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Account for zonal upgrade sequencing in Service Fabric timeouts,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-291-account-for-zonal-upgrade-sequencing-in-service-fabric-timeouts/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.