You can upgrade an enrollment server by running the latest version of the Connection Server installer on the virtual machine that already has an earlier version of an enrollment server installed. Or, you can uninstall the earlier version of an enrollment server and install the latest version by running the latest version of the Connection Server installer and selecting the Enrollment Server option.
An enrollment server is stateless. The configuration related to True SSO does not get persisted on the enrollment server. The enrollment server receives the True SSO configuration from Connection Server when the enrollment server is running and the Connection Server successfully connects to the enrollment server.