I have two.
1. Provide the ability to select a user/group to see all policies applied to it. Maybe even a test to enter a username and site to see if it would be blocked on that users as this would help in troubleshooting in large companies with multi-site users.
2. Allow blocked site enforcement. For instance if you have a user assigned to two groups but only one of the groups has a site blocked explicitly enforce the blocked site. Currently the on premise version has this but not the cloud version per the response I got on ticket number: 01520861.