Hi Paul,
Yes, when we use multisite vCenter Single Sign-On server all the manual steps required to maintain SSO synchronization. You would need to upgrade the primary site vcenter components and secondary site components step by step .
Example: SSO at pri/sec, Web Client at Pr/Sec etc