Points of Presence (PoP) Overview

Cloud Secure Edge (CSE) uses Points of Presence (PoP) to streamline users' connections to resources while helping admins maintain control over data residency. In the CSE ecosystem, a PoP is essentially a CSE-managed Access Tier: while Access Tiers are self-hosted in Private Edge deployments, PoPs are fully hosted and maintained by CSE in a Global Edge deployment.

PoP provisioning is integrated directly into the initial org setup and ongoing management phases within a Secure Private Access (SPA) org: New SPA orgs are guided through a mandatory selection of 1 to 4 PoPs. This ensures the environment is functional before the admin enters their console.

Once onboarded, admins retain the flexibility to modify their PoPs list. If the initial selection no longer meets the org's needs, locations can be added or removed. Admins can provision additional PoPs as long as they adhere to their current maximum limit. If an org requires a higher capacity, the maximum number of allowable PoPs can be increased via the MoM (Manager of Managers) Console.

The PoP selection feature is only available for Global Edge deployments in orgs created after the March 2026 release.

Impact of Selecting PoPs

The management of PoPs is designed to balance security with operational simplicity. Admins have total control over which PoPs are used: Connectors, clients, and egress IPs are tethered specifically to the selected PoP locations, which ensures that data never traverses a region or country deemed out-of-scope, allowing for adherence to regional compliance. By narrowing the PoP selection, the complexity of egress IP whitelisting is drastically reduced. Instead of managing hundreds of potential IP addresses, admins only need to allowlist a small handful, simplifying the security workflow.

While admins must select at least 1 PoP on a Global Edge deployment with SPA licensing, it is recommended that admins select 2 PoPs to create high availability in their infrastructure.

PoP Provisioning Statuses