> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-upgrade-and-rollout-control.md).

# Cortex XDR agent upgrade and rollout control

Control Cortex XDR agent upgrades and rollout rates in Cortex XDR, including automatic updates, schedules, and failure handling.

Cortex XDR lets you control when, and how quickly, new Cortex XDR agent releases and content updates reach your endpoints. Upgrades are driven from the console; you don't need third-party software distribution tools.

### Upgrade methods

| Method            | How it works                                                                                                                                                                                                              |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Manual upgrade    | Select endpoints in **All Endpoints**, then right-click and select **Endpoint Control** → **Upgrade Agent Version**. You can push a package to up to 5,000 endpoints per action. Track progress in the **Action Center**. |
| Automatic upgrade | Enable auto-upgrade in an **Agent Settings** profile. Auto-upgrade is disabled by default.                                                                                                                                |
| Mobile            | Upgrade Android from Google Play and iOS from the App Store, or push the app from your MDM.                                                                                                                               |

### Automatic upgrade scope

When auto-upgrade is enabled, choose which releases endpoints receive:

* **Latest agent release**
* **One release before the latest one**, including its maintenance releases
* **Only maintenance releases** (no move to a newer major release)
* **Only maintenance releases in a specific version**

You can also schedule rollouts to run **immediately** or **delayed** after a release, and restrict upgrades to specific days and hours.

### Limit the rollout rate

To reduce risk, auto-upgrades of a new release roll out to a single batch of agents during the first week. After that, the number of parallel upgrades follows the value you configure in [global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/configure-global-agent-settings). Content-update bandwidth is controlled in the same place.

{% hint style="warning" %}
Auto-upgrade is not available for mobile, VDI, and Terminal Server installations. You cannot upgrade a Cortex XDR agent on a VDI golden image; reinstall the relevant version on the golden image instead.
{% endhint %}

### Monitor upgrades and handle failures

* Track the status and failure reason of each upgrade in [Monitor agent upgrade status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-upgrade-status).
* While an upgrade action is **Pending**, you can cancel it from the **Action Center**.
* If an upgrade does not complete, the endpoint keeps running its installed Cortex XDR agent version. To move it to a known-good release, push the installation package for that release.

For recommended practices, see [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/guidelines-for-keeping-cortex-xdr-agents-and-content-updated).

### Remove Cortex XDR agents after a migration

To retire Cortex XDR agents in bulk, for example after a pilot or a migration, uninstall them from the console. See [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-upgrade-and-rollout-control.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.