You can upgrade an enrollment server by running the latest version of the Connection Server installer on the virtual machine that already has an earlier version of an enrollment server installed. Or, you can uninstall the earlier version of an enrollment server and install the latest version by running the latest version of the Connection Server installer and selecting the Enrollment Server option.
An enrollment server is stateless. The configuration related to True SSO does not get persisted on the enrollment server. The enrollment server receives the True SSO configuration from Connection Server when the enrollment server is running and the Connection Server successfully connects to the enrollment server.
Note: After upgrading you do not need to manually import the pairing certificate(s) from the Connection Server to the enrollment server’s Windows Certificate Store again. The pairing certificate(s) manually imported earlier are not removed as part of the uninstall or upgrade process. When the enrollment server is running after an upgrade, the Connection Server is able to successfully connect and the previously imported pairing certificate(s) are reused.