Hello Tivadar
When configuring Cisco AnyConnect, it is possible to configure what is known as a management VPN tunnel. This VPN tunnel ensures connectivity to the corporate network whenever the client is powered up, and not just when a VPN connection is establi9shed by the end-user.
This management tunnel allows administrators to have management access to AnyConnect devices without user intervention. This facilitates things like patch management, upgrades, and some endpoint OS login scripts.
It is because of this management VPN that you are able to update Windows using SCCM. You can find out more about it at this Cisco documentation:
More info about how to configure this feature can be found here:
I hope this has been helpful!
Laz