Upgrading Kaspersky when installed via Intune

[paul_33]

We use Kaspersky Endpoint Security Cloud and the instructions included installing through Intune. There was no agent to install, they simply suggested pushing out the entire distribution package through intune. This worked out fine, but now there is a new version (12.10.0.466). If I 'prepare the distribution package' it will automatically start updating clients, but this is problematic. Intune is setup to detect the install of version 12.9. Am I supposed to disable this pushed install entirely when we need to update? 

Is there a way to get this package without pushing it to all users? I would much rather let intune handle this so that future intune devices also get the latest Kaspersky app. 

The only way around this that I can see is to disable the intune install, push out the new package, immediately download said package and create a new intune install. But what happens? Intune is going to try and install the update at the same time as Kaspersky cloud, which I have to imagine is going to cause all sorts of grief. 

Is there a better way to handle this? Like an agent I can push through intune that doesn't install the app until the cloud console tells it to? That is how ESET handled things and we never had to worry about it. 

If anyone else uses Intune please let me know how you handle this