Reset Search



KB40544 - Pulse Minimum Client Version Enforcement Feature Overview

« Go Back


Last Modified Date6/7/2022 5:56 PM
This article provides an overview of the Pulse Minimum Client Version (MCV) Enforcement feature 
Problem or Goal
The minimum client version enforcement feature makes it possible for PCS admins to enforce that a minimum version of the Pulse client be installed on the user's system before they can connect with a VPN tunnel to the corporate network.  When enabled from the PCS device, if the version of Pulse is below the minimum version set by the PCS admin, then the user must upgrade the Pulse client in order to connect or stay connected.

This feature is supported in Pulse Connect Secure (PCS) OS 8.3 and up and can be enforced on Mac and Windows endpoints running Pulse desktop 5.2 and up.

  1. Navigate to Users > Pulse Secure Client > Components
User-added image
  1. Select the option for Enable minimum client version enforcement, then specify the minimum version in the field provided in the following format:


Note: The minimum client version entered in the field provided must match the active package on the device or users will not be able to upgrade Pulse and will not be able to connect. 

For Pulse Desktop Client 5.3 and above:
If the minimum version is higher, then end user will be prompted to Upgrade or Disconnect and the corresponding action is taken when selected.

User-added image

With Pulse Desktop Client 5.2RX:
If the minimum version is 5.3 or above, then the Setup Client will be upgraded to the version that matches the Pulse Desktop Client version being enforced and once connected  displays a warning that "A Required Pulse upgrade must be installed or the current session will be disconnected."  

User-added image

Once the user clicks "OK" they are presented with the software upgrade notification and can accept the upgrade by clicking Upgrade or Cancel.

User-added image

Note: If the upgrade is not triggered within 7 minutes, then the session is automatically disconnected.  Therefore, if the user selects "Cancel" and the upgrade is not triggered then the VPN tunnel will remain connected for 7 minutes and then the user will be disconnected.  The user will need to reconnect and accept the upgrade to stay connected.

With Pulse Desktop 5.1 and lower:
If the Windows or Mac user has Pulse desktop 5.1 or lower installed, then the minimum client version enforcement feature will have no effect and an alternate method of compliance should be used, such as Host Checker.

Important Consideration: Although Pulse 5.2 is supported for this feature, the upgrade prompt presented to Pulse 5.2 users relies on the already built-in messaging for this Pulse release and gives the end-user the option to choose "Cancel" when prompted which will disconnect their session after 7 minutes of use.  To avoid end-user confusion it is recommended to deploy Pulse 5.3 with this feature as the upgrade prompt in 5.3 is updated and provides the user with the option to "Upgrade" or "Disconnect".  


Changes in PCS 9.0R1 to MCV functionality

From PCS 9.0R1 the MCV feature blocks Pulse clients with a lower version from connecting and they will not be presented with the option to upgrade. This is described in the 9.0R1 PCS, PPS and PDC What's New Document as:

Minimum Client Version Enforcement - Server side.
• This release adds enhancements to minimum client version enforcement to handle older clients, and to prevent the tunnel from being established at all if the client version is below the minimum specified. This addresses shortcomings in the earlier implementation where clients could get access for a brief window  

Users can use a browser to access the gateway and upgrade Pulse otherwise to allow Pulse clients to directly upgrade via the gateway the admin would need to disable MCV so users get the upgrade prompt.  Please refer to the section Manage Pulse Secure Client Versions of the 9.0 or later Admin Guides for more information.

Changes in PCS 9.1R14 to MCV functionality

From PCS 9.1R14 the MCV feature gives the option to  (force) upgrade the Pulse client to the version specified under the minimum version on the appliance. Administrators need to enable the "Force upgrade Pulse Desktop" option to enforce upgrade.

User-added image

Users will see the below message once they connect to the VPN with any version lower than the specified minimum client version.

User-added image

Note: Upgrade is forced (automatic) only with Pulse client version 9.1R11.3 and above. 
Related Links
Attachment 1 
Created ByKaren Mayberry



Was this article helpful?



Please tell us how we can make this article more useful.

Characters Remaining: 255