Stagger GlobalProtect App Updates

If you have not yet created it, create a user group for the first group of users to which you want to roll out the GlobalProtect app update.
You can use User-ID to map users to groups, or select
Device
Local User Database
User Groups
to manually create a group.
Create a new GlobalProtect agent configuration to use for the first group of users.
In Panorama, select
Network
GlobalProtect
Portals
.
Select the
Mobile_User_Template
from the
Template
drop-down.
Select
GlobalProtect_Portal
to edit the
Prisma Access
portal configuration.
Select the
Agent
tab.
Select the
DEFAULT
configuration and
Clone
it.
You can also
Add
a new configuration; but cloning the existing configuration copies over required information for the new configuration.
Specify a
Name
for the configuration.

Select the
Config Selection Criteria
tab.
In the
User/User Group
area, select the user you created in Step 1.

Select the
App
tab.
Change
Allow User to Upgrade GlobalProtect App
to either
Allow with Prompt
or
Allow Transparently
.
Allow with Prompt
prompts users when a new version is activated and allows them to upgrade their software when it is convenient;
Allow Transparently
automatically upgrades the app software whenever a new version becomes available on the portal.

Click
OK
to save your changes.
Select
Move Up
to move your configuration above the default configuration.
When an app connects, the portal compares the source information in the packet against the agent configurations you have defined. As with security rule evaluation, the portal looks for a match starting from the top of the list. When it finds a match, it delivers the corresponding configuration to the app.

Repeat these steps for the
DEFAULT
configuration, but change
Allow User to Upgrade GlobalProtect App
to
Disallow
to prevent users from updating to the latest GlobalProtect app software.
When you want to let the rest of the users update their apps, change
Allow User to Upgrade GlobalProtect App
in the
DEFAULT
configuration to a selection that allows it (either
Allow with Prompt
or
Allow Transparently
).