If the hybrid service uses directory data collected by Websense Directory Agent to identify users, you can either configure the hybrid service to automatically create a hybrid logon password for all user accounts sent by Directory Agent (see Send user and group data to the hybrid service), or you can have users request their own password the first time they connect to the hybrid service from outside a filtered location (see Off-site user self-registration).

If your organization does not use directory data collected by Directory Agent to identify users connecting to the hybrid service, you can let users self-register for the service. See Configure user access to the hybrid service.

Once you have established an identification policy for off-site users, mark Enable off-site users on the Settings > Hybrid Configuration > User Access page in the Web Security manager. See Configure user access to the hybrid service.