You can always use the legacy approach to automate the upgrade directly. 

Use a file-sync rule to send the device agent .apk file to the relevant device(s), and initiate the installation/upgrade automatically upon file transfer completion with the post-sync script of the file-sync rule.

If you have a managed play account, just add mobicontrol to the application policies and assign it to your devices. Then the playstore will update the agent when a new version is available.

But the most secure way and to keep conttol the package as Raymond mentioned is the way to go for.

It is not an Android for Work device, but thank you for your reply
I think the issue was connected to the fact we upgraded to the latest agent version which was a pre release.
I remoted to the devices and dropped the latest apk on there and install it
I will monitor to see if it happens again with the next release

Even if the device is enrolled with AE device agent, I would not recommend using an app policy to deploy upgraded device agent from Managed Google store for stability reason.  If wrong options have been configured for the app policy or on the Managed-Google Play store,  resultiing in an unsuitable device agent upgraded to the wrong/incompatible devices, then the worst case maybe is to recall the device or factory reset the device for re-enrollment.

Raymond how do you deploy agent updates to the AE devices if not via the Managed Playstore / App Catalog

Newer MobiControl servers support device action to perform device agent upgrade.

For older servers without such support, one can choose to use the file-sync rule approach mentioned in my earlier post.

File sync rule or just use a package with the apk in should work too.

We prefer packages instead of file sync rule because you can directly see how many devices got the package etc. which you can't in file sync rule.

Even our MDM provider sais that file sync creates many traffic (requesting on every connection/checkin to check if there's something new for the device).

But interesting is, that the "update agent" functionality still didn't work here (we are on 14.4), so wondering that it does by you.

The upgrade function is not working properly for us either already a year or so.

I still do not understand how it works for you.
As soon as we upgrade the agent on the server and the red icon with "Agent outdated" is displayed on all devices, from then on no sync rules, profile assignments or the like work anymore.
As long as the agent on the client is older than the agent on the server, nothing happens on the device that is managed.

The only chance is to connect to the device with remote control, transfer the APK and install the apk via script /install.