How to maintain and update Azure Function Connector deployed via WEBSITE_RUN_FROM_PACKAGE?

Background

We recently completed a migration from the legacy Microsoft Sentinel Box connector to the newer Box Events (CCP) connector.

During the migration we discovered that the legacy Box connector was implemented using:

Azure Functions
JWT authentication
WEBSITE_RUN_FROM_PACKAGE

The Function App is configured as:

WEBSITE_RUN_FROM_PACKAGE=https://aka.ms/sentinel-BoxDataConnector-functionapp

and the Azure Function therefore operates in read-only mode because it is running directly from the package referenced by that URL.

The migration to the new Box Events (CCP) connector has been successful and is now ingesting data into BoxEventsV2_CL using Client Credentials Grant (CCG) authentication.

What prompted the question

While reviewing the legacy Azure Function deployment, we noticed that:

The Box Solution GitHub repository has received updates over time.
The Box Solution itself has been updated (currently v3.16 in our environment).
Analytics, parsers, and connector components have evolved.
The legacy Azure Function deployment still appears to be tied to the original package referenced by WEBSITE_RUN_FROM_PACKAGE.

This raised a broader lifecycle and maintenance question:

Questions

1. Is the package referenced by: https://aka.ms/sentinel-BoxDataConnector-functionapp
still actively maintained and republished by Microsoft?

2. If updates are made to the Box Solution source code or supporting files in the GitHub repository, are those updates expected to flow automatically to existing Azure Function deployments that use WEBSITE_RUN_FROM_PACKAGE?

3. If updates do not automatically flow to existing deployments, what was the intended maintenance model for customers using the legacy Azure Function connector?

For example, were customers expected to:

Continue using the Microsoft-hosted package URL indefinitely?
Periodically redeploy using updated templates?
Download and self-maintain the Function App package?
Modify the Function App to stop using WEBSITE_RUN_FROM_PACKAGE?

4. Prior to the introduction of the Box Events (CCP) connector, how were customers expected to apply updates, dependency changes, security fixes, and other improvements to existing Box Azure Function deployments?

5. Is migration to the Box Events (CCP) connector now considered the only supported path for customers wishing to remain current with Microsoft Sentinel Box integrations?

Reason for asking

The goal is not to troubleshoot the new CCP connector.

Rather, we are trying to better understand the support and maintenance lifecycle of the legacy Azure Function-based Box connector and how Microsoft intended customers to remain current when deployments were originally made using a Microsoft-hosted WEBSITE_RUN_FROM_PACKAGE endpoint.

Any clarification from the Box Solution maintainers or Microsoft Sentinel team would be appreciated.

NB
I came across this notice after following some links from the Box Solution listed in Azure.
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/known_issues.md#known-issue-2--solution-re-deployment-or-update
That seems to indicate that somehow we are meant to Redeploy the entire package when there is an update and then somehow copy / update all the Custom Analytics Rules and Automations. Is there no way to merge the new modules and updates without basically having to start over with a side-by-side deployment?

Forum Discussion