Upgrade Autonomous DEM Agent Using Canary Group

Table of Contents

Upgrade Autonomous DEM Agent Using Canary Group

Control and validate Autonomous DEM agent upgrades in a controlled environment, ensuring stability and smooth deployments before broad organizational rollout.

Where Can I Use This?	What Do I Need?
Strata™ Cloud Manager	Strata Cloud Manager Pro Agents version 5.10.4 and above GlobalProtect® license 6.2.8 and above Or Prisma Access Agent license 25.0 and above

The Autonomous DEM Agent Canary Upgrade feature allows you to control and validate new agent versions in your network. The Canary Upgrade feature provides a precise control over agent deployments and mitigates risks by allowing controlled validation before broad deployment.

You can validate agent performance and compatibility on a small scale to ensure new agent versions are stable and ready for tenant-wide deployment. This significantly reduces service disruptions and provides a more reliable upgrade experience. Strata Cloud Manager notifies you of upgrades, providing control and visibility into the upgrade lifecycle.

Planned Upgrades: Planned upgrades follow a predictable 45-day life cycle to allow for internal validation.
- Preparation (Day N-15): A notification banner appears two weeks before the Canary phase. During this time, you can add or remove users from the Canary group. The Canary Upgrade is limited to a maximum of 30 users per tenant. Any users or groups beyond the first 30 users are not considered for the Canary Upgrade.
- Canary Phase (Day 0–30): Once the Canary phase starts, existing users cannot be removed. You may add users until you reach a maximum of 30.
- Global Rollout (Day 30+): After day 30, the latest agent upgrade is made available globally. At this time all ADEM agents,including those not included in the Canary group are automatically marked for upgrade. This rollout occurs in a phased manner by region.
Emergency Upgrade: In the event of a critical security vulnerability, an emergency upgrade may be issued. These versions bypass the standard 15-day notification window and all agents including Canary group agents are upgraded immediately.
Hotfixes: Hotfixes are targeted releases designed to address specific bugs or localized performance issues. You have a Canary period of 7 days before the automatic upgrade. You can add users (up to a total of 30 users per tenant) during the Canary phase, but you cannot remove users once the phase has started.

Create and Manage ADEM agent Canary Upgrades

Add Canary Group.
1. Launch Strata Cloud Manager and click System Settings > Access Experience Management. If a new agent version is available for upgrade, you will see a notification 15 days prior to when you can test the upgrade.
2. Click Configure Canary Group. This button is available upon release of a new agent version when no canary group is active.
3. Define the criteria for the canary group, such as selecting specific users or groups to participate. Ensure users or user groups provide unique host IDs for effective participation. The user groups that belong to Cloud Identity Engine (CIE) and firewalls are displayed here.
4. Click Save and Run.
Add or Edit Users and Groups within a Canary group.
1. To add more users to an existing Canary group, click Add to Canary Group.
  The canary upgrade is limited to a maximum of 30 users per tenant. Any users or groups beyond the first 30 users are not considered for the Canary upgrade.
2. To adjust the composition of an active Canary group, select Edit Canary Group. This option is available after a Canary batch closes or for future upgrades.
Monitor agent upgrade status from the Users and Devices table.
1. After day 30, the latest agent version is made available globally. At this time all ADEM agents,including those not included in the Canary group are automatically marked for upgrade. This rollout occurs in a phased manner by region.
  
  You are notified of successful upgrades, any emergency upgrades or if the upgrades are paused due to any issue found during testing in the Access Experience Agent Management, Application Experience, and Insights > Users pages.
2. Access the Users and Devices table in the Settings > Access Experience Management page.
3. Review the Upgrade Status and Canary Group columns in the Users and Devices table.
4. Toggle Monitoring State to enable or disable monitoring of a particular agent.
5. For agents that require a manual upgrade, the Upgrade Status is shown as Manual Upgrade.
6. Refine your view based on the upgrade status, agent versions, Canary user groups, mobile users, and browsers, browser plugin versions (for Real User Monitoring (RUM) scenarios) using the filters provided in the table.