Allow Users to Upgrade the GlobalProtect App (Panorama)

1. Select NetworkGlobalProtectPortals.
2. Select the Mobile_User_Template from the Template drop-down.
3. Select GlobalProtect_Portal to edit the Prisma Access portal configuration.
4. Select the Agent tab and select the app configuration.
5. Select the App tab.
6. In the App Configurations area, select a choice in Allow User to Upgrade GlobalProtect App to specify whether mobile users can upgrade their GlobalProtect app version to the active version that is hosted on Prisma Access and, if they can, whether they can choose when to upgrade:

   • Allow with Prompt (default)—Prompt users when a new version is activated and allow users to upgrade their software when it is convenient.
   • Disallow—Prevent users from upgrading the app software.
   • Allow Manually—Allow users to manually check for and initiate upgrades by selecting Check Version in the GlobalProtect app.
   • Allow Transparently—Automatically upgrade the app software whenever a new version becomes available on the portal.
   • Internal—Automatically upgrade the app software whenever a new version becomes available on the portal, but wait until the endpoint is connected internally to the corporate network. This prevents delays caused by upgrades over low-bandwidth connections.
     If you select Allow Transparently or Internal, you must also create a Custom URL category for the URL pan-gp-client.s3.dualstack.us-west-2.amazonaws.com and allow traffic from the URL in the rule. You can also allow only the download for *.pkg and *.msi files in the rule for greater granularity.