It is actually the expected behaviour. The DNS forward of Cisco Anyconnectr Umbrella roaming module is running at kernel level and it doesn't need to change the local DNS settings like the standalone Umbrella roaming client. Please refer to the follo...
Basically WSA is using AVC (Application Visibility and Control) to only block Youtube HD video.
If it is over HTTPs, you also need to ensure "Decrypt for Application Detection: " is also enabled in WSA HTTPs proxy>Decryption Options.
If it is still ...