Stage the Rollout of Prisma Access Agent Upgrades

1. Navigate to the Prisma Access Agent setup.

   • From Strata Cloud Manager:
     1. Log in to Strata Cloud Manager as the administrator.
     2. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
   • From Panorama:
     1. From the Cloud Services plugin in the Panorama that manages your Prisma Access or NGFW deployment, select PanoramaCloud ServicesPrisma Access AgentLaunch Prisma Access Agent.
     2. Select ConfigurationPrisma Access AgentSettings.

     3. Select Prisma Access Agent.
2. In the Staged Rollouts section, click Add Ring.

3. Select a predefined Name for the ring. You can select from Ring0 to Ring4. The first ring that you will add is Ring0.

4. Enter a meaningful Description for the ring.
5. Specify the criteria for the ring based on the User, Groups, or Device OS attributes.

   1. Add a criteria.

   2. For each criterion, select an Attribute, Operator, Value, and then click Add. You can select only one attribute and operator per criterion. The value depends on what you selected for the attribute and operator:

      • For the Username attribute:
        • If you select OperatorContains, select or search for a username from the Value list. To start a search, start typing the username. You can select one or more usesrnames from the list.

        • If you select OperatorEquals, select or search for a username from the Value list. To start a search, start typing the username. You can select one usesrname from the list.

      • For the Groups attribute:
        • If you select OperatorContains, select or search for a group from the Value list. To start a search, start typing the group name. You can select one or more groups from the list.

        • If you select OperatorEquals, select or search for a group from the Value list. To start a search, start typing the group name. You can one group from the list.

      • For the OS attribute:
        • On Strata Cloud Manager Managed Prisma Access:
          • For the OS attribute, select an OS type (Windows or macOS). Then:
            • If you select OperatorContains, search for or select one or more OS versions from the Value list. To start a search, start typing the OS and version. You can select one or more OS versions from the list.

            • If you select the Greater than or Less than operator, search for or select an OS version from the Value list. To start a search, start typing the OS and version. You can select one OS version from the list.

        • In Panorama Managed Prisma Access or Panorama managed NGFW deployments:
          For the OS attribute:
          • If you select OperatorContains, select an OS version from the Value list. To search for an OS, start typing the OS name. You can select one or more versions of the OS from the list.

          • If you select the Greater than or Less than operator, select an OS version from the Value list. To search for an OS, start typing the OS name. You can select one OS version from the list.

   3. If needed, Add more criteria. You can specify up to three criteria per ring.

      You can use an attribute only once per ring. After you add a criteria using an attribute, that attribute will no longer appear in the Attribute drop-down.

      After you added the criteria, the criteria is displayed in the Criteria table in the Ring Criteria page. When Prisma Access evaluates the criteria, the values listed in the same cell are evaluated using the logical OR operator, while the attributes and values between the rows are evaluated using the logical AND operator.

      For instance, the criteria in the following image will match those devices that belong in the gp-auto-saml-group or Okta Administrators group and run the Windows 11 operating system.

   4. Save the ring criteria.
6. To create more rings, repeat steps 2-5. You can create a total of five rings (Ring 0 to Ring 4).
7. When you are ready, push the configuration to by selecting Push ConfigPush.
8. After the push config job has completed, you can start a staged rollout when an upgrade is available.