If a device is configured to use DNS servers other than Umbrella's, it is possible to bypass any filtering rules configured for an organization. Fortunately, it is quite easy to create a firewall rule to block any DNS requests going to servers other than Umbrella:
To request a firewall of this nature be put into place on a Networkmaine-provisioned EdgeRouter, please send an email to support@msln.net requesting the implementation of an Umbrella bypass block rule.