Managing POPs

Policy Orchestration Points (POPs) define the connection between the Platform Tenant to the SaaS Application.

To manage Policy Orchestration Points, you can

• Create a POP
• Edit a POP
• Change the mode
• Delete a POP

Creating a POP

To create a Policy Orchestration Point:

1. In the Environment side panel, click on the Integrations Workspace (formerly Orchestration Workspace), click Add Policy Orchestration Point. The Select Vendor side panel opens.
2. Select the third-party vendor. A form opens, enabling you to configure the new POP.
3. In the General section, enter a:
   • Display Name (required)
   • POP ID (required)
   • Description (optional)
4. Fill out the POP settings section. For more information about each mode, refer to the Changing the POP Mode section in this article.
5. In the Associated Workspaces, select the targeted Policies or Identities Workspace.
6. In the Connection Settings section, enter the relevant values for each parameter. Refer to the SaaS Authorization Management article and refer to the third-party vendor you use for connection details.
7. Click Test Connection to verify that the new POP can connect to the third-party vendor app and that the user has the appropriate permissions. For more information about the permissions, refer to the third-party vendor documentation in SaaS Authorization Management
   • If the Connection Test fails, an error appears below the Test Connection button indicating what needs to be fixed.
8. When the Test Connection is successful, click Create. The new POP is added to the list of currently defined POPs and an initial discovery takes place.

Editing a POP

To edit a POP:

1. Click the three vertical dots on the POP you wish to edit, and select Settings. The POP side panel opens with the current configuration in Edit mode. All of the fields except the Authentication Method can be changed.
2. After you make any changes, click the Test Connection button to verify that the POP is still configured properly and can connect to the third-party vendor.
3. When the Test Connection is successful, click Save.

Changing the POP Mode

In the Integrations Workspace (formerly Orchestration Workspace), you can switch between three modes:

• Learn Mode: PlainID discovers the vendor's Policies and fully synchronizes them into the Platform, overriding any differences. Use this mode to see how the vendor defines Policies.
• Monitor Mode: PlainID discovers changes made directly in the vendor and flags them for review, without overriding Policies in the Policies Workspace. You can adopt vendor changes gradually using Accept Vendor Changes. Monitor Mode uses the same connection and permission requirements as Learn Mode, so PlainID doesn't need write permissions on the vendor.
• Manage Mode: PlainID takes control of Policies. You can create, edit, and deploy Policies to the vendor, and PlainID tracks differences from the vendor for visibility and reconciliation. Manage Mode requires write permissions on the vendor.

You can switch between these modes at any time, depending on your governance needs.

Comparing the Modes

When to Use Monitor Mode

Use Monitor Mode when you want visibility into vendor-side changes without granting PlainID write permissions on the vendor. For example, many organizations grant write permissions only in specific Environments. In the other Environments, Monitor Mode still lets you:

• Discover changes made directly in the vendor and see them flagged in the Platform.
• Review each change before you adopt it, instead of PlainID overriding your Policies automatically.
• Adopt vendor changes into the Platform with Accept Vendor Changes.

Monitor Mode is designed for changes that flow from the vendor into the Platform. If you run Accept Platform Changes and the POP doesn't have the required vendor write permissions, the operation fails and the Platform displays an error message that explains what's missing.

Switching from Learn Mode to Monitor/Manage Mode

Switching to Monitor Mode or Manage Mode activates change tracking. From this point, PlainID stops overriding Policies in the Policies Workspace, and it shows changes as differences between the Platform and the vendor. The switch itself doesn't change any Policies.

Before you switch to Manage Mode, ensure the POP has the vendor write permissions that Manage Mode requires. Monitor Mode doesn't require any permissions beyond those for Learn Mode.

Switching from Monitor/Manage Mode to Learn Mode

Switching back to Learn Mode runs an Override All operation. This resets any undeployed changes you made in PlainID and re-syncs the Platform with the vendor's latest Policies. A confirmation popup appears before the switch completes.

For details on how the Platform shows and resolves Policy differences in Monitor and Manage Mode, see Orchestration Side Panels.

Deleting a POP

When you delete a Policy Orchestration Point, all associated objects generated by the POP are also permanently deleted from the Platform. This includes the following:

• POP
• Scope
• Application
• Policies discovered or created within the POP.
• Building Blocks including Dynamic Groups, Actions, Rulesets, and Conditions.
• Asset Types (including Attributes)
• Identity Sources
• Identity Attributes

To delete a POP:

1. In the Integrations Workspace, locate the POP you wish to delete in the list of Policy Orchestration Points.
2. Click on the three vertical dots on the POP to access the drop-down menu.
3. Click Delete POP. A warning message appears, asking you to confirm that you want to delete the POP.
4. Click Delete to confirm. The POP is deleted, as well as all associated objects and Policies within the POP.