You can do everything from the CLI. The feature is built into certain product versions which would eliminate the need for the COP file. Thou if you want to avoid some additional downloading/updating of the module then you could deploy a COP file.
After talking with TAC and some ASE/BU people at Cisco it appears they never considered that there might be password expiration policies on an account for the proxy. This means every time the password changes you have to go to every server with that feature and change it via the CLI via clearing the proxy then re-adding it.
The only solution I see at hand is to use something like a script within a SSH client like SecureCRT to basically program the code entry and run it against every server which would remove most of the manual work.
Of note is there was a concept for an on-prem aggregator/collector called CCUC edge. This would allow one connection to the Cloud while all on-premise devices would send data to it. That would be a solution as there is only one place to make the change versus what could be dozens for larger enterprises. This was only a concept in a presentation I saw from 12-13 months ago and I do not know if it got any farther than a mere concept.
