Assuming this is a DNS deployment, in the dashboard you can disable "Backoff Behind Virtual Appliance"
See https://docs.umbrella.com/deployment-umbrella/docs/roaming-computer-settings-1 for docs
There should be no change in this behavior between Roaming Client and Secure Client. We'll look into it though.
For Firefox, it the encrypted DNS should not kick on because of the use-application-dns.net domain as noted here: https://support.umbrella...