Skip to content
DoctorDO
Demo

Learn

Delivery Optimization, the parts that matter.

This page covers how Delivery Optimization gets Windows updates and Intune Win32 apps from peers, Microsoft Connected Cache, and Microsoft’s CDN, and the settings and network rules that decide which. Every point links to Microsoft’s documentation, and the portal’s guides go into more depth.

By Maurice Daly, Microsoft MVP since 2017 and co-founder of MSEndpointMgr. Shaped with endpoint management practitioners from the MSEndpointMgr community. Checked against Microsoft Learn on 14 October 2026.

How DoctorDO works

A collector on each device, everything else in your Azure subscription.

DoctorDO reads what Windows already records about Delivery Optimization and never sits in the download path. Devices keep getting their bytes from peers, Connected Cache, and Microsoft’s CDN exactly as before. DoctorDO adds a small signed report from each device, and a portal that turns the reports into findings.

How DoctorDO works1. Intune delivers the collector: An Intune remediation installs the DoctorDO collector, a PowerShell module, checks its files against the release’s SHA-256 list, and runs it on a schedule as SYSTEM. Packaging the module as a Win32 app is optional. 2. The device sends a signed report: The collector reads what Windows records about Delivery Optimization (status, logs, policy, and connectivity probes) and sends a small report over HTTPS to your ingest endpoint, signed with the device’s Microsoft Entra device key. 3. Ingest checks who sent it: The ingest function checks the signature and looks the device up in Entra ID through Microsoft Graph. The report goes on a Service Bus queue, and the device gets an empty HTTP 202 in reply. 4. The processor analyses it: The processor checks the device against the Intune device list it reads from Microsoft Graph, and drops a report from a device Intune does not manage. It analyses the rest with DoctorDO’s rules and stores devices, sites, findings, and the trend in PostgreSQL. 5. You read it in the portal: You sign in to the portal, a Static Web App, with Microsoft Entra ID. The portal reads the results through its API. 6. Optional connections: If you connect them, the API also reads your Windows Update for Business reports workspace, and asks Azure OpenAI in your subscription for the report’s briefing. Delivery Optimization keeps moving the bytes between devices, peers, Connected Cache, and Microsoft’s CDN. DoctorDO is not in the download path.MICROSOFTYOUR NETWORKA SITEYOUR AZURE SUBSCRIPTION · DOCTORDOMicrosoft CDNThe contentDO cloud serviceMatches peersMicrosoft IntuneRuns the collectorEntra ID · GraphDevice identityConnected CacheIf you have oneWindows devicesDoctorDO collectorPeersOther devicesYouAny browserIngestAzure FunctionsQueueService BusProcessorAzure FunctionsPostgreSQLResults and trendWUfB reportsLog AnalyticsPortalStatic Web AppPortal APIAzure FunctionsAzure OpenAIThe briefingTCP 768012345Entra sign-in6
Delivery Optimization’s bytes from peers, Connected Cache, and the CDNDoctorDO’s reports and readsIdentity, policy, and peer matching, which carry no contentOptional

  1. Intune delivers the collector

    An Intune remediation installs the DoctorDO collector, a PowerShell module, checks its files against the release’s SHA-256 list, and runs it on a schedule as SYSTEM. Packaging the module as a Win32 app is optional.

  2. The device sends a signed report

    The collector reads what Windows records about Delivery Optimization (status, logs, policy, and connectivity probes) and sends a small report over HTTPS to your ingest endpoint, signed with the device’s Microsoft Entra device key.

  3. Ingest checks who sent it

    The ingest function checks the signature and looks the device up in Entra ID through Microsoft Graph. The report goes on a Service Bus queue, and the device gets an empty HTTP 202 in reply.

  4. The processor analyses it

    The processor checks the device against the Intune device list it reads from Microsoft Graph, and drops a report from a device Intune does not manage. It analyses the rest with DoctorDO’s rules and stores devices, sites, findings, and the trend in PostgreSQL.

  5. You read it in the portal

    You sign in to the portal, a Static Web App, with Microsoft Entra ID. The portal reads the results through its API.

  6. Optional connections

    If you connect them, the API also reads your Windows Update for Business reports workspace, and asks Azure OpenAI in your subscription for the report’s briefing.

Statements marked DoctorDO’s reading are DoctorDO’s own reading of the evidence. Everything else is Microsoft’s documentation, linked beside it.

How Delivery Optimization works

Download modes and sources: where the bytes come from.

Windows downloads updates and apps in pieces, from Microsoft’s CDN, from a Connected Cache, and from other devices that already have them. A few settings decide which.

Checked against Microsoft Learn on 13 October 2026.

  1. 01

    Download mode decides who a device peers with

    DODownloadMode is the first thing to check on any device. HTTP only (0) peers with no one but still uses the cloud service; LAN (1) peers with devices behind the same public IP; Group (2) with devices that share a Group ID, across subnets and offices; Internet (3) adds peers outside your organisation; Simple (99) uses neither peers nor the cloud service, for offline networks. Microsoft recommends Group (2) for most organisations. To turn peering off, use 0. Bypass (100) is deprecated in Windows 11 and can make some content fail to download.

    Microsoft documentation

    Full guide in the live demo: How Delivery Optimization works › Download modes

  2. 02

    Small files and small devices do not peer

    Unless you change them, a file under 50 MB is not peered at all, a downloaded file stays available to peers for 3 days, and the cache takes up to 20% of available disk space. A device needs 4 GB of memory and 32 GB of disk before it uploads to peers, and it does not upload on battery.

    DoctorDO’s reading When peers connect but little is transferred, look first at the cache size, the cache age, and the minimum file size.

    Microsoft documentation

    Full guide in the live demo: How Delivery Optimization works › Who can be a peer

  3. 03

    Microsoft Connected Cache serves content inside your network

    Microsoft Connected Cache is a software-only cache inside your network. Delivery Optimization takes pieces from it at the same time as from peers and the CDN, and the CDN is always the fallback. Configuration Manager can install one on a distribution point, where it serves cloud-managed content only; Connected Cache for Enterprise and Education is managed in the Azure portal. Microsoft calls it “a persistent local content source for Windows Autopilot provisioning”.

    Microsoft documentation

    Full guide in the live demo: How Delivery Optimization works › The parts, and Coming from Configuration Manager › Connected Cache on a distribution point

  4. 04

    Measure a device before you change it

    Get-DeliveryOptimizationStatus reports five sources for each download: BytesFromHttp (the HTTP source, usually Microsoft’s CDN), BytesFromCacheServer (Connected Cache), BytesFromLanPeers, BytesFromGroupPeers, and BytesFromInternetPeers. Two counters overlap: BytesFromPeers is the sum of the three peer counters, and BytesFromHttp includes the Connected Cache bytes. Get-DOConfig -Verbose shows each policy’s value and which provider set it.

    Microsoft documentation

    Full guide in the live demo: How Delivery Optimization works › Where the bytes come from

Firewall rules

Ports 7680 and 3544: what the network has to allow.

The hosts and ports Delivery Optimization needs, the firewall rules that open them, and the proxy settings that break it with no error on the device.

Checked against Microsoft Learn on 13 October 2026.

  1. 05

    Peers need TCP 7680 open between them

    In download modes 1, 2, and 3, peers share content over TCP 7680, which the Delivery Optimization service registers and opens itself. Open it on the device and on any internal firewall between devices that should peer. UDP 3544 (Teredo) matters only in Group (2) or Internet (3) mode, where peers sit behind different NATs; TCP 443 and 80 are always used.

    DoctorDO’s reading Blocking 7680 fails quietly. Downloads carry on over 80 and 443, and devices never serve or receive peer content.

    Microsoft documentation

    Full guide in the live demo: Firewall rules › Ports

  2. 06

    Never TLS-inspect the Delivery Optimization service

    Download modes 0 to 3 rely on the cloud service at *.do.dsp.mp.microsoft.com on HTTPS 443; without it a device gets no peer matches and every byte comes from the CDN. Allow it by name, because Microsoft publishes no IP list. The client pins the certificate, so TLS inspection breaks the connection, and Microsoft states there is no workaround. A proxy must also pass byte-range requests (HTTP 206) intact and leave the client’s source IP unaltered on calls to the service.

    Microsoft documentation

    Full guide in the live demo: Firewall rules › The Delivery Optimization cloud service, and Proxy requirements

  3. 07

    Nothing listening on 7680 is usually normal

    The Delivery Optimization service shuts down when idle and stops listening on 7680; it also stops with an empty cache, download mode 99, low battery, Connected Standby, a cellular connection, or a VPN. UDP 3544 blocked in LAN mode is not a fault either, because Teredo is only required for Group and Internet modes. Slow first downloads behind a proxy are expected, while proxy discovery and authentication come first.

    DoctorDO’s reading DoctorDO doesn’t treat these as faults on their own: the listener check fails only when the device looks as if it is transferring content while nothing listens. A tool that flags behaviour Microsoft documents as normal teaches people to ignore it.

    Microsoft documentation

    Full guide in the live demo: Firewall rules › Expected behaviour that is not a fault

Group IDs

Group IDs: who counts as the same office.

In Group mode a device peers with devices that share its Group ID. Where that ID comes from decides whether an office peers with itself, with nobody, or across a paid WAN link.

Checked against Microsoft Learn on 13 October 2026.

  1. 08

    A Group ID applies only in Group mode

    DOGroupId and DOGroupIdSource apply only in Group (2) download mode; in any other mode Windows ignores them, and if DOGroupId is set, DOGroupIdSource is ignored. The source can be the AD site (1), the authenticated domain SID (2), DHCP option 234 (3), the DNS suffix (4), or the Microsoft Entra tenant ID (5); a value outside 0 to 5 makes Windows ignore the policy. With neither set, Windows uses the AD site, then the domain SID, then the tenant ID, and if DHCP or the DNS suffix fails it falls back to that order silently.

    Microsoft documentation

    Full guide in the live demo: Group IDs › When a Group ID applies, and DOGroupIdSource values

  2. 09

    Restrict peers by subnet, or by local discovery

    DORestrictPeerSelectionBy narrows who a device peers with inside LAN or Group mode: 1 keeps it to the subnet, 2 to Local Peer Discovery over DNS-SD. With Local Discovery the cloud service is not used to find peers, and it is the one option that still peers when Delivery Optimization detects a VPN. Microsoft’s pages give three different Windows 11 defaults for it.

    DoctorDO’s reading So if Windows 11 devices in Group mode do not peer across subnets, set it explicitly rather than rely on a default. DoctorDO holds back the check that depends on this setting until the behaviour has been tested in a lab.

    Microsoft documentation

    Full guide in the live demo: Group IDs › Restricting peer selection

Coming from Configuration Manager

Delivery Optimization isn’t a distribution point under a new name.

Where content lives, who tells a client where to get it, and what to check when a workload moves to Intune.

Checked against Microsoft Learn on 14 October 2026.

  1. 10

    Nothing is staged ahead

    In Configuration Manager you decide in advance where content will be. With Delivery Optimization, content starts on Microsoft’s CDN, and at download time the cloud service, not a server of yours, matches each device with peers that have it. It carries Microsoft’s content, such as Windows updates, Microsoft 365 Apps, and Intune Win32 apps, and it is not in the Configuration Manager client’s content source priority list. Your distribution points stay for Configuration Manager content.

    Microsoft documentation

    Full guide in the live demo: Coming from Configuration Manager › Staged ahead, or shared on demand

  2. 11

    BranchCache and Peer Cache do not cover it

    Windows 11 does not support BranchCache for content Delivery Optimization downloads, and BranchCache discovery stops at the subnet, where Group mode can span subnets and sites. Peer Cache serves from the Configuration Manager client cache on TCP 8003; Delivery Optimization keeps its own cache and peers on TCP 7680, so a firewall rule made for Peer Cache does not cover it.

    Microsoft documentation

    Full guide in the live demo: Coming from Configuration Manager › BranchCache, and Peer Cache

Policy assignment

Autopilot and fallback delays: don’t make a new device wait.

Which Delivery Optimization profile reaches which device, and when, above all for Windows Autopilot.

Checked against Microsoft Learn on 14 October 2026.

  1. 12

    Fallback delays can stall Autopilot

    Four settings make a download wait for peers or a cache before it uses the HTTP source: DODelayForegroundDownloadFromHttp, DODelayBackgroundDownloadFromHttp, DODelayCacheServerFallbackForeground, and DODelayCacheServerFallbackBackground. While a device waits, “the download appears to be stuck for the end user”. Devices being provisioned are transient peers that might not stay online long enough to serve later devices. The Enrollment Status Page shows an error when installation takes longer than its time-out, 60 minutes by default. For Autopilot, Microsoft says to set the foreground HTTP delay to 0 and the background one to 0 or a low value.

    DoctorDO’s reading That makes a device being provisioned the one most likely to have no peer or cache to wait for, and the one a delay holds up most.

    Microsoft documentation

    Full guide in the live demo: Policy assignment › The fallback delays, and Why provisioning feels it

  2. 13

    Keep the provisioning profile apart from the everyday one

    Two Intune profiles that set the same setting to different values on one device are a conflict you resolve by hand, and the setting might fail to apply at all. The simplest pattern is one profile for every device with Microsoft’s provisioning values. Otherwise target a provisioning profile with an assignment filter on the enrollment profile name, a dynamic group of Autopilot devices, or the device group an Autopilot device preparation policy names, and exclude the same devices from the everyday profile.

    DoctorDO’s reading Microsoft documents no filter or group rule that ends when provisioning does, so devices keep the provisioning values until you move them on.

    Microsoft documentation

    Full guide in the live demo: Policy assignment › Assignment patterns

Guides

DO reports, Connected Cache, Win32 apps, and a troubleshooting checklist.

Four longer pages, each on one question Intune administrators ask about Delivery Optimization.

Further reading

The posts DoctorDO grew out of

The About page lists the Delivery Optimization posts on MSEndpointMgr behind these rules, and what each one covers.

Where the knowledge comes from
All 24 Microsoft pages cited on this page
  1. 1Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
  2. 2Policy CSP: DeliveryOptimization (opens in a new tab)learn.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization
  3. 3How Delivery Optimization works (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-workflow
  4. 4What is Microsoft Connected Cache? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache
  5. 5Microsoft Connected Cache with Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/microsoft-connected-cache
  6. 6Microsoft Connected Cache for Enterprise and Education overview: plan for Windows Autopilot provisioning (opens in a new tab)learn.microsoft.com/windows/deployment/do/mcc-ent-edu-overview
  7. 7Monitor Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-monitor
  8. 8Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
  9. 9Microsoft Connected Cache content and services endpoints (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-endpoints
  10. 10Using a proxy with Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-proxy
  11. 11Delivery Optimization frequently asked questions (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-faq
  12. 12Testing Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-test
  13. 13What is Delivery Optimization? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization
  14. 14Fundamental concepts for content management in Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management
  15. 15Configure BranchCache for Windows client updates (opens in a new tab)learn.microsoft.com/windows/deployment/update/waas-branchcache
  16. 16Peer cache for Configuration Manager clients (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/client-peer-cache
  17. 17About client settings in Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/clients/deploy/about-client-settings
  18. 18Delivery Optimization settings for Windows devices in Intune (opens in a new tab)learn.microsoft.com/intune/device-configuration/templates/ref-delivery-optimization-settings-windows
  19. 19Set up the Enrollment Status Page (opens in a new tab)learn.microsoft.com/intune/device-enrollment/windows/setup-status-page
  20. 20Common questions, answers, and scenarios with policies and profiles in Microsoft Intune (opens in a new tab)learn.microsoft.com/intune/device-configuration/troubleshoot-device-profiles
  21. 21Platforms, policies, and app types supported by assignment filters (opens in a new tab)learn.microsoft.com/intune/fundamentals/filters/ref-supported-workloads
  22. 22App and device properties, operators, and rule editing for assignment filters (opens in a new tab)learn.microsoft.com/intune/fundamentals/filters/ref-device-properties
  23. 23Create device groups for Windows Autopilot (opens in a new tab)learn.microsoft.com/autopilot/enrollment-autopilot
  24. 24Overview of Windows Autopilot device preparation (opens in a new tab)learn.microsoft.com/autopilot/device-preparation/overview

Every guide, beside the findings it explains.

Five guides in the live demo cover each topic in full, with tables, diagrams, and a worked example of what a fallback delay costs. Every company, site, and figure in ContosoAI is invented; the problems are ones met in real estates. Its figures are modelled, not computed from collector reports. DoctorDO is in preview.

Open the demo portalGet started