Two zones or three? A design framework for zone-resilient Azure workloads

Mark Russinovich and co-authors argue that zone resiliency is a per-component decision, not one number for a whole workload. Three replicas are not three failure domains: a quorum system split across two zones still loses quorum.