topic Re: Updating Cortex Agent by MDM in Cortex XDR Discussions

Updating Cortex Agent by MDM

QuestionAb — Tue, 28 Apr 2026 16:49:53 GMT

Hello team,

I need guidance on automating Cortex XDR agent upgrades across multiple endpoints using an MDM.

Upgrading directly from the console is consuming significant bandwidth. We are evaluating options like P2P distribution, brokers, or staging updates, but face some challenges:

Some endpoints are not associated with a broker.
Upgrades may require cytool protect disable, which complicates automation.
We want to minimize manual intervention.

Could you please advise on:

Best practices for large-scale agent upgrades via MDM
Handling tamper protection during automated upgrades
Optimizing bandwidth usage (P2P vs broker vs other methods)
Ensuring endpoints associate with brokers effectively

Or Can I require a update.exe to Palo Alto?

Any official recommendations or documentation would be appreciated.

Thanks.

Re: Updating Cortex Agent by MDM

susekar — Wed, 29 Apr 2026 13:28:56 GMT

Hello @QuestionAb ,

Greetings for the day.

Automating Cortex XDR agent upgrades effectively involves balancing initial deployment via MDM with the native automated lifecycle management capabilities of the Cortex XDR console.

1. Best Practices for Large-Scale Agent Upgrades via MDM:

The recommended approach for large environments is to use your MDM (e.g., Intune, Jamf) primarily for the initial baseline installation. Once the agent is installed and communicating with the console, rely on the native Agent Auto-Upgrade policy for ongoing version management.

Native Auto-Upgrade:
This is the most efficient method because it removes the need to continuously create new MDM packages or update application detection rules for every minor release.

Phased Rollout Strategy:
Regardless of the deployment method, use a gradual rollout:

Control Group: Diverse, low-risk endpoints (about 1 week of testing)
Initial Wave: ~10% of endpoints (medium risk)
Broad Waves: Expand to 40%, then 80%, and finally 100%

2. Handling Tamper Protection During Automated Upgrades:

Console-led Upgrades:
When upgrades are initiated from the Cortex XDR console, tamper protection (SPROT) is automatically handled during the process.

MDM/Script-led Upgrades (Windows):
If performing upgrades via MDM or scripts, you must explicitly disable tamper protection using the uninstall password before running the installer:

ECHO [AGENT_UNINSTALL_PASSWORD] | "C:\Program Files\Palo Alto Networks\Traps\cytool.exe" protect disable
msiexec /i cortexxdr_x64.msi /qn /l*v C:\XDRtemp\XDRupgrade.log

Linux:
Running the installer script with sudo or as root handles the upgrade automatically without manual tamper protection steps.

3. Optimizing Bandwidth Usage:

To avoid network congestion during large-scale upgrades:

Download Source Priority:
Configure agent settings to prioritize internal sources such as Peer-to-Peer (P2P) or Broker VM before reaching out to the cloud.

Global Upgrade Scheduler:
Use centralized controls to:

Limit the number of parallel upgrades (typically 500–2000 depending on version)
Restrict upgrades to specific time windows (minimum 4-hour window)

Distribution Packages:
When downloading installers for MDM deployment, use distribution packages that include both the MSI and the latest content. This reduces the bandwidth spike immediately after installation.

4. Broker Association and Installer Behavior:

Broker Association:
You can assign or update proxy/broker settings directly from the console by selecting endpoints and applying agent proxy configurations.

Installer Behavior:
Palo Alto Networks provides an MSI installer for Windows. This single package functions as both a fresh install and an upgrade when executed on a system with an existing agent.

(Important Considerations)

End-of-Life (EOL) Agents:
Upgrading from very old versions (such as 7.x to 8.x) may not support direct in-place upgrades. In such cases, uninstalling the old agent and performing a clean installation is recommended.

MDM Detection Rules:
When deploying upgrades through MDM, ensure detection rules (e.g., MSI Product Code) are updated to match the new version. Otherwise, the MDM may repeatedly attempt to reinstall older versions.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: Updating Cortex Agent by MDM

QuestionAb — Tue, 05 May 2026 20:35:58 GMT

Thank you so much @susekar

I want to confirm whether, when running an older version (for example, 7.9), it is possible to upgrade directly to a newer version (such as 9.1) over the existing agent without generating a new Agent ID.

In my testing, I performed a manual upgrade from version 8.8 to 9.1 by installing the new package over the existing agent, and the result was that the agent upgraded successfully while preserving its identity (Agent ID).

Based on this, I assume the same behavior should apply when performing the upgrade through a management tool such as MDM. However, I would like to confirm if there are any additional considerations or limitations in this scenario.

Best regards

Re: Updating Cortex Agent by MDM

susekar — Thu, 07 May 2026 13:35:51 GMT

Hello @QuestionAb ,

Thank you for the response.

While your testing from version 8.8 to 9.1 was successful, performing a direct upgrade from version 7.9 to 9.1 is generally not supported and is likely to fail due to the significant version gap and the End-of-Life (EOL) status of the 7.9 agent.

1. Upgrade Feasibility and Identity Preservation

Identity (Agent ID)

In a standard successful in-place upgrade (manual or MDM), the agent preserves its identity (Agent ID). The agent maintains connectivity using locally stored credentials and configuration even when installation packages are replaced.

Version 7.9 Limitations

Multiple internal resources indicate that direct upgrades from version 7.x to current major versions (8.x or 9.x) often fail or roll back. This is due to major architectural changes and the lack of intermediate migration components in EOL agents.

Console vs. Manual/MDM

Console-based auto-upgrade functionality is officially supported for agents 8.1 and newer. For 7.x agents, a manual or MDM-driven re-installation is typically required for such major version jumps.

2. Considerations for MDM Deployment (SCCM/Intune)

When using MDM tools to install a newer version over an older one:

Automatic Detection:
The standard Windows installer (.msi) is designed to detect older versions and perform an in-place upgrade automatically.
Failure Risks:
For EOL versions like 7.9, the installer may treat the environment as corrupted or fail to stop existing services gracefully, resulting in:
- Failed installation
- Upgrade rollback
- A machine left without an active agent
Recommended Workflow for 7.9:
The recommended approach for agents this old is a full uninstallation followed by a fresh installation of the target version.

Recommended Upgrade Procedure

Uninstall the old agent using the Cortex XDR Cleaner tool
Perform a mandatory system reboot
Install Cortex XDR Agent version 9.1 as a fresh installation.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar