Firewall rules

The services under that wildcard, for reading proxy logs. Allow the wildcard rather than the individual names.⁶

Source: Microsoft Connected Cache content and services endpoints.²

# Delivery Optimization client allow-list (FQDNs; Microsoft publishes no IP list)
# Source: learn.microsoft.com/windows/deployment/do/delivery-optimization-endpoints
# Do NOT TLS-inspect *.do.dsp.mp.microsoft.com (certificate pinning).
*.do.dsp.mp.microsoft.com
*.cdn.office.net
*.dl.delivery.mp.microsoft.com
*.manage.microsoft.com
*.officecdn.microsoft.com
*.res.cdn.office.net
*.static.microsoft
*.windowsupdate.com
*.xboxlive.com

Source: the rule set in Microsoft’s privileged access deployment guide.⁵

What goes wrong in practice

• A rule that is present but disabled, scoped to the wrong profile (Domain, Private, Public), or overridden by a broader block rule from a security baseline. A missing rule is the rarer case.DoctorDO’s reading
• AllowLocalPolicyMerge set to false: firewall rules from the local store are then ignored and not enforced.⁷ Microsoft also warns that it can stop the DHCP client retrieving option 235, which breaks Connected Cache discovery, especially with Windows Autopilot.¹

# The Delivery Optimization rules as the device enforces them (local, GPO and MDM merged)
Get-NetFirewallRule -PolicyStore ActiveStore -DisplayName 'Delivery Optimization*' |
  Select-Object DisplayName, Enabled, Direction, Action, Profile

# Any enabled block rule that names port 7680
Get-NetFirewallPortFilter -PolicyStore ActiveStore |
  Where-Object { $_.LocalPort -contains '7680' } |
  Get-NetFirewallRule |
  Where-Object { $_.Enabled -eq 'True' -and $_.Action -eq 'Block' } |
  Select-Object DisplayName, Direction, Profile

1. No TLS inspection of the Delivery Optimization and Connected Cache endpoints, including geo.prod.do.dsp.mp.microsoft.com and array*.prod.do.dsp.mp.microsoft.com. The client pins the certificate; Microsoft states there is no workaround.³
2. Byte-range requests pass through intact, with HTTP 206 Partial Content responses.³
3. The client’s source IP is not altered on calls to the service: it uses the IP for geo-location and peer matching.³ Content downloads may go through the proxy.

How each one shows up

Symptom mapping is DoctorDO’sDoctorDO’s reading; the requirements are Microsoft’s.³

Which proxy setting Delivery Optimization uses

It depends on whether a user is signed in. Background and scheduled downloads run as NetworkService, with no user.³

• Every endpoint below, on each documented port: name resolution, a TCP connection, a TLS handshake that checks the certificate is valid for the name (and, where Microsoft pins it, that its issuing chain is Microsoft’s, not an inspecting proxy’s, whatever the certificate’s own subject says), and an HTTP answer.²³
• Byte ranges: one Range: bytes=0-0 request for a file the device itself downloaded, expecting 206. A 200 with the whole object means something in the path strips ranges.³ No test object is needed.
• Wildcards are tested on hosts the device used, then on hosts a Microsoft page names, and otherwise shown as “not testable”. DoctorDO never guesses or enumerates names under a wildcard.DoctorDO’s reading
• Through the proxy Delivery Optimization would use in the background (a netsh winhttp proxy first, then the device-wide setting, WPAD or PAC), with a direct connection tried for comparison.³
• On the device: DoSvc listening on 7680, the Delivery Optimization firewall rules in force and any policy that blocks inbound connections regardless of them, LocalPolicyMerge, and in Group and Internet modes Teredo’s operational state (qualified, dormant or offline), not only its configured type.¹¹⁰ UDP 3544 itself cannot be probed, so a pass is not proof that the port is open.DoctorDO’s reading
• Connected Cache: TCP 80 to the configured server and Microsoft’s verification request, with the smallest byte range.⁹

Probes are small and bounded: 4 seconds per step, eight hosts at a time, 40 seconds in all, and results are reused on the device for six hours. Nothing is downloaded beyond response headers and a single byte, and no URL leaves the device.DoctorDO’s reading

The endpoints tested

Verified against Microsoft Learn on 2026-10-19. From the Windows 10 2004 endpoint list only the Delivery Optimization, Windows Update, Store, Microsoft 365 and Edge entries are tested; telemetry, consumer features, sign-in portals and the cache server’s own management endpoints are left out, each with its reason recorded in the manifest.DoctorDO’s reading

See your devices’ results in ConnectivityNetwork findings in ConnectivityRoll out the collector