Add the ability to block IP ranges of public VPN Services on a per tenant basis. I know some people like to use VPN services, but most smb's don't use these, but the bad guys certainly do. Bonus for ability to whitelist a specific reputable VPN service as needed.