I don't think this is well known - but if you have even a single other Cisco security product licence (such as a single Umbrella licence), you can use Cisco SecureX to cloud manage your AnyConnect clients. Even if you don't want to use Umbrella - you should buy a single licence (and not use it) because this feature is so good.
You can have multiple profiles, like "Test" and "Production". You can move clients between profiles via the SecureX cloud. A profile contains all the AnyConnect configurations and version to use. If you update anything, the change is pushed out to all clients automatically via the Cisco SecureX cloud - they don't need to connect via AnyConnect to get the changes.
Even if you are using AnyConnect on another Cisco platform - you should be using this.
For example, to push out the "fixed" version to all our clients, I just have to do this one change in our production profile:
Anyone who has used the AnyConnect profile editor to create the XML file (which you no longer need to do with this system) will recognise all of these settings in the SecureX cloud.
