Upgrade Autonomous DEM Agent Using Canary Group

Table of Contents

Upgrade Autonomous DEM Agent Using Canary Group

Control and validate Autonomous DEM agent upgrades in a controlled environment, ensuring stability and smooth deployments before broad organizational rollout.

Where Can I Use This?	What Do I Need?
Strata™ Cloud Manager	ADEM Prisma Access license Agents version 5.10.4 and above GlobalProtect® license 6.2.8 and above Or Prisma Access Agent license 25.0 and above

The Autonomous DEM Agent Canary Upgrade feature allows you to control and validate new agent versions in your network. The Canary Upgrade feature provides a precise control over agent deployments and mitigates risks by allowing controlled validation before broad deployment.

You can validate agent performance and compatibility on a small scale to ensure new agent versions are stable and ready for tenant-wide deployment. This significantly reduces service disruptions and provides a more reliable upgrade experience. Strata Cloud Manager notifies you of upgrades, providing control and visibility into the upgrade lifecycle.

Planned Upgrades: Planned upgrades follow a predictable 30-day life cycle to allow for internal validation.
- Canary Phase (Day 0–30): You can continue to add any number of users to the Canary group at any point during the 30-day period, giving you complete flexibility to expand the Canary group as needed.
- Global Rollout (Day 30+): After day 30, the latest agent upgrade is made available globally. At this time all ADEM agents,including those not included in the Canary group are automatically marked for upgrade. This rollout occurs in a phased manner by region.
Emergency Upgrade: In the event of a critical security vulnerability, an emergency upgrade may be issued.
Hotfixes: Hotfixes are targeted releases designed to address specific bugs or localized performance issues. You have a Canary period of 7 days before the automatic upgrade. You can add users during the Canary phase, but you cannot remove users once the phase has started.

Create and Manage ADEM agent Canary Upgrades

Add Canary Group.
1. Launch Strata Cloud Manager and click System Settings > Access Experience Management. If a new agent version is available for upgrade, you will see a notification 15 days prior to when you can test the upgrade.
2. Click Configure Canary Group. This button is available upon release of a new agent version when no canary group is active.
3. Define the criteria for the canary group, such as selecting specific users or groups to participate. Ensure users or user groups provide unique host IDs for effective participation. The user groups that belong to Cloud Identity Engine (CIE) and firewalls are displayed here.
4. Click Save and Run.
Add or Edit Users and Groups within a Canary group.
1. To add more users to an existing Canary group, click Add to Canary Group.
2. To adjust the composition of an active Canary group, select Edit Canary Group. This option is available after a Canary batch closes or for future upgrades.
Monitor agent upgrade status from the Users and Devices table.
1. After day 30, the latest agent version is made available globally. At this time all ADEM agents,including those not included in the Canary group are automatically marked for upgrade. This rollout occurs in a phased manner by region.
  
  You are notified of successful upgrades, any emergency upgrades or if the upgrades are paused due to any issue found during testing in the Access Experience Agent Management, Application Experience, and Insights > Users pages.
2. Access the Users and Devices table in the Settings > Access Experience Management page.
3. Review the Upgrade Status and Canary Group columns in the Users and Devices table.
4. Toggle Monitoring State to enable or disable monitoring of a particular agent.
5. For agents that require a manual upgrade, the Upgrade Status is shown as Manual Upgrade.
6. Refine your view based on the upgrade status, agent versions, Canary user groups, mobile users, and browsers, browser plugin versions (for Real User Monitoring (RUM) scenarios) using the filters provided in the table.