You need to position your inbound routes in the order you want the cloud security services to try to deliver the email traffic. The primary routes are at the top of the lists, followed by the fail over routes. You can change the order of primary and fail over routes.
You can only promote a route to primary if it has been checked in the previous 24-hour period. To have an existing route rechecked, click the Check button. Once the route passes all the technical checks, the status of the route under the "Can promote to primary" column will change to "Yes".