Azure ATP Sensor Update - Does it require manual install of MSI?

[nitin nagar]

I would appreciate if we can get clarity on if major update for Azure ATP sensor will require download of MSI package and deployment by admin on each Domain Controller OR this is done automatically?

We are trying to understand if there is any way we can control installation and deployment of major upgrades of Azure ATP sensor on Domain Controller servers in Production environment. From Microsoft documentation it seems that if delayed upgrade selected then does it mean that after 72 hours the Azure ATP Sensor is updated automatically on Domain Controllers.

Please advise

[#2]

@nitin nagar 
No, no need for manual actions, the updater will take care of major updates as well if any.

Those are extremely rare.
You can control for each DC if you allow it to auto restart or not. if not, and a major update is pushed, the sensor will be pending a manual restart to complete the update.

see https://docs.microsoft.com/en-us/azure-advanced-threat-protection/sensor-update

"Control automatic sensor restarts (for major updates) in the Azure ATP portal configuration page."

Note that we are working on removing the major updates , so we won't need them any more, thus won't need to reboot  at all, but this is a bug effort and will take months at best.

Eli

[#3]

@Eli Ofek  First thanks for responding to my question. Can you please also confirm if the Azure ATP sensor after update BUT before restart of domain controller WILL CONTINUE to operate as usual. If Yes, then is there any time limit before which the domain controller must be restarted?

We are trying to ensure that we have some control over restarting domain controllers in our production environment and at the same time ensure that Azure ATP sensors continue to operational even when domain controllers are required to be restarted after delayed upgrade.

Please advise

Thanks

Nitin

[#4]

@nitin nagar We do our best to maintain support for the previous version so it can still be functional until update completes. we need that because of the option to delay a deployment.

in some cases it will be partially online, and might not yet work with new features.

Also, if you keep it like that too long (many days), while we try to preserve backwards compatibility a few versions back, we can't grantee it  , so the advice is to reboot as soon as possible to complete the update.

While that said, those majors are extremely rare. from GA till now it happened ONCE. 
and since it rare, we do make an effort to let customers know via the different community channels that it is coming... and in most chances will also let you know how you can prepare to avoid the need to reboot, for example, if you are currently running .net 4.7.0, and we found an issue that will force us to move to 4.8, and this will require a reboot, we will tell you ahead that if  you upgrade to .net 4.8 at will before that at your own time, and there are no other pending reboots on the machine, the update  will complete without the need to reboot at all.
This is true for new deployments as well, we suggest to customer to pre install .net 4.7 or higher before on their own planned time, this way when deploying the sensor for the first time, if there are no pending reboots already, they won't need a reboot at this point as well.