For me the key additions are: 1) integration with our org Identity Provider 2) NAT traversal + DERP relay fallback 3) Tailscale’s ACL functionality.