If the hybrid service uses directory data collected by Directory Agent to identify users, you can either configure the hybrid service to automatically create a hybrid logon password for all user accounts sent by Directory Agent (see Send user and group data to the hybrid service), or you can have users request their own password the first time they connect to the hybrid service from outside a filtered location (see Off-site user self-registration).

If your organization does not use directory data collected by Directory Agent to identify users connecting to the hybrid service, you can let users self-register for the service. See Configure user access to the hybrid service.

Once you have established an identification policy for off-site users, mark Enable the hybrid service off-site users on the Web > Settings > Hybrid Configuration > User Access page in the Forcepoint Security Manager. See Configure user access to the hybrid service.

Select Route traffic based on end users' egress IP on the Settings > Hybrid Configuration > User Access to re-route your web traffic to data centers based on the location of the end user, rather than your DNS. See Configure user access to the hybrid service.