Skip to content
DoctorDODemo data
Signed in as Alex Morgan, alex.morgan@contosoai.example, Admin.

Demo data: ContosoAI (fictitious). Nothing here is a real company, device or person.

Learn

Coming from Configuration Manager

Delivery Optimization is not a distribution point, BranchCache or Peer Cache under a new name. Where content lives, who tells a client where to get it, and what to check when a workload moves to Intune.

01

Staged ahead, or shared on demand

The biggest change is not a setting. In Configuration Manager you decide in advance where content will be; with Delivery Optimization, Windows works it out at download time.
  • Microsoft CDN (HTTP)
  • Connected Cache
  • LAN · Group · Internet peers
  • ConfigMgr distribution point
  • BranchCache · Peer Cache
  • No bytes
  • Policy or control (no content)
  • Blocked
  • Line weight follows bytes

One key for every diagram on this page. Only Delivery Optimization’s own sources take the CDN grey, the Connected Cache blue and the teal of peers, as everywhere else in DoctorDO; Configuration Manager’s content paths have colours of their own.DoctorDO’s reading

Fig. 1 · The same branch office, two waysWhat you build, and what Windows does.

Distribution point

Configuration Manager: clients download from a distribution point in their boundary groupHEAD OFFICEBRANCH BOUNDARY GROUPSite serverContent libraryManagement pointBranch DPDistribution pointClientsstaged ahead, over the WANHTTP or HTTPScontent location
The site server copies content to the branch distribution point when you distribute it, ahead of the deployment. When a client needs it, the management point lists the distribution points in the client’s boundary group, and the client downloads from one of them.

Delivery Optimization

Delivery Optimization: devices download from Microsoft’s CDN and share pieces with each otherBRANCH · ONE GROUP IDMicrosoft CDNDO cloud serviceMatches peersPeersDevicesfirst copyin parallelTCP 7680peer list
Nothing is staged in advance. The Delivery Optimization cloud service tells each device which devices in its group have the content; it downloads pieces from them over TCP 7680 and from Microsoft’s CDN in parallel, and the CDN is always there as the fallback.
Describe this diagram

Distribution point

The site server copies content to the branch distribution point when you distribute it, ahead of the deployment. When a client needs it, the management point lists the distribution points in the client’s boundary group, and the client downloads from one of them.

Places

  • Head office: Site server, Management point
  • Branch boundary group: Branch DP, Clients

Parts

  • Site server (Configuration Manager site server): Content library
  • Management point (policy source)
  • Branch DP (Configuration Manager distribution point): Distribution point
  • Clients

Connections

  • Site server → Branch DP: Configuration Manager content, active (staged ahead, over the WAN)
  • Branch DP → Clients: Configuration Manager content, active (HTTP or HTTPS)
  • Management point → Clients: Control, no content (content location)

Delivery Optimization

Nothing is staged in advance. The Delivery Optimization cloud service tells each device which devices in its group have the content; it downloads pieces from them over TCP 7680 and from Microsoft’s CDN in parallel, and the CDN is always there as the fallback.

Places

  • Branch · one Group ID: Peers, Devices

Parts

  • Microsoft CDN (internet source)
  • DO cloud service (cloud service, no content): Matches peers
  • Peers
  • Devices

Connections

  • Microsoft CDN → Peers: HTTP download, active (first copy)
  • Microsoft CDN → Devices: HTTP download, active (in parallel)
  • Peers → Devices: Group peering, active (TCP 7680)
  • DO cloud service → Devices: Control, no content (peer list)

Configuration Manager: you place the content

Content lives on site servers and distribution points that you own. You distribute it to each distribution point and control the WAN copy with schedules, throttling, pull-distribution points or prestaged content.1 Boundary groups (IP subnets, AD sites, IPv6 prefixes, IP ranges or VPNs) tell a client which site systems it may use.3 When it needs content, the client asks its management point, which returns the valid sources for that request in priority order.1

Delivery Optimization: Windows finds the content

Delivery Optimization is an HTTP downloader in Windows with a cloud-managed service, which lets a device take the same download from other devices or a cache server as well as from Microsoft’s servers.17 Nothing is staged. Content starts on Microsoft’s CDN; the DO cloud service, not a server of yours, matches each device with peers that have it, and every piece from a peer is checked against a hash before it is used.18 A device that has downloaded something serves it to its peers for three days by default.20

It carries Microsoft’s content, not yours: Windows updates, Store apps, Defender definition updates, Microsoft 365 Apps, Edge and Intune Win32 apps among others, each with its own mix of HTTP, peer and Connected Cache support.17 The whole mechanism is in How Delivery Optimization works.

02

Side by side

Four ways to get content to a branch office, compared on the questions a Configuration Manager admin asks first. Ports are the defaults.
Distribution points, BranchCache, Peer Cache and Delivery Optimization compared
QuestionDistribution pointBranchCachePeer CacheDelivery Optimization
Who holds the contentServers you own, filled from the site server before clients need it.1Clients on the same subnet that already downloaded it from a BranchCache-enabled distribution point.1Clients you enable as peer cache sources, from their Configuration Manager client cache.12Microsoft’s CDN, any device that already has the content, and a Connected Cache server if you run one.17
How a client finds a sourceIt asks its management point, which returns the valid sources for its boundary groups, in priority order.1It gets the content information from the distribution point, then sends a WS-Discovery multicast probe on its subnet.19The management point lists online sources in the client’s current boundary group, at the top by default.124The DO cloud service matches peers by content, then Group ID, then external IP and location.18
What keeps it off the WANBoundary groups, and fallback to a neighbour group only after the time you set.1The subnet: peers are only found on the same one.1Boundary groups: a neighbour group’s sources are never offered.12Download mode and Group ID, optionally narrowed to the subnet. Configuration Manager can set the Group ID from the boundary group.195
Client ports (defaults)TCP 80 for HTTP or TCP 443 for HTTPS; alternate ports can be set.6UDP 3702 to discover and TCP 80 to retrieve, client to client. A hosted cache server takes offers on TCP 443.1011TCP 8003 to download from a source, HTTP or HTTPS on the same port; UDP 8004 for the initial broadcast a task sequence sends in Windows PE. The management point checks a source is online over TCP 10123.512TCP 7680 between peers; UDP 3544 (Teredo) across NATs in Group or Internet mode; TCP 443 to the cloud service.19
Content it carriesEverything Configuration Manager deploys: applications, packages, software updates, OS deployments.1Configuration Manager content, except OS images.2All Configuration Manager content, including images downloaded in Windows PE.2Microsoft content that uses Delivery Optimization: Windows updates, Store apps, Defender definitions, Microsoft 365 Apps, Edge, Intune Win32 apps and more.17
What you configureThe distribution point role, boundary groups and their relationships, and distributing the content.1The Windows BranchCache feature on the distribution point; clients in distributed cache mode with BITS enabled; the deployment option, on by default.7The Enable as peer cache source client setting on a collection. Allow peer downloads in this boundary group is on by default.124Download mode and Group ID, from Intune, Group Policy or Configuration Manager client settings, and a cache host if you run Connected Cache.19
When that source is unavailableThe next source in the list: a neighbour boundary group after its fallback time, the site default boundary group, then cloud sources if allowed.1The client downloads from the distribution point itself, then carries on down the list.1A busy source refuses (low battery, processor over 80%, disk queue over 10, no free connections) and the client tries the next location.12The HTTP source, Microsoft’s CDN: at once, unless delay policies make it wait for peers or a cache.19

03

BranchCache

A Windows feature since Windows 7 and Windows Server 2008 R2, which Configuration Manager uses on top of its distribution points.

BranchCache has two modes. In distributed cache mode each client caches what it downloads and serves it to the others; in hosted cache mode a designated server in the branch holds the cache for its area. Microsoft prefers distributed cache mode for Windows client updates.8

Configuration Manager supports distributed cache mode only.8 Add the Windows BranchCache feature to the distribution point, with nothing else to configure on the server; configure clients for distributed cache mode with the BITS client settings enabled; and leave BranchCache on in the deployment, where it is the default.7 The Configure BranchCache client setting turns it on for clients and sets its share of the disk.5

Fig. 2 · BranchCache in distributed cache modeThe WAN is crossed once per subnet.
BranchCache: the first client in a subnet downloads from the distribution point, the rest from itHEAD OFFICEBRANCH · ONE SUBNETHead office DPBranchCache enabledManagement pointFirst clientCaches what it getsOther clientsonce, over the WANmetadata onlysame subnet onlycontent location
The first client downloads from the BranchCache-enabled distribution point across the WAN and caches what it gets. The other clients on the same subnet still ask the distribution point for the content information, then find the content on that client with a multicast probe and download it from there.
Describe this diagram

The first client downloads from the BranchCache-enabled distribution point across the WAN and caches what it gets. The other clients on the same subnet still ask the distribution point for the content information, then find the content on that client with a multicast probe and download it from there.

Places

  • Head office: Head office DP, Management point
  • Branch · one subnet: First client, Other clients

Parts

  • Head office DP (Configuration Manager distribution point): BranchCache enabled
  • Management point (policy source)
  • First client: Caches what it gets
  • Other clients

Connections

  • Head office DP → First client: Configuration Manager content, active (once, over the WAN)
  • Head office DP → Other clients: Configuration Manager content, active (metadata only)
  • First client → Other clients: BranchCache peer transfer, active (same subnet only)
  • Management point → Other clients: Control, no content (content location)

One download

  1. The client asks the BranchCache-enabled distribution point for the content’s BranchCache metadata.1
  2. It sends a WS-Discovery multicast probe on its subnet, on UDP 3702; clients that hold the content reply.910
  3. It retrieves the content from them over HTTP on TCP 80, checking each block against the hashes it got from the server.910
  4. If no client has it, it downloads from the distribution point itself, then caches it for the next client.19

BranchCache and Delivery Optimization

  • They don’t share content. Windows 11 doesn’t support BranchCache for content downloaded by Delivery Optimization,8 and on a device that has both, Delivery Optimization is used instead.17
  • For updates, BranchCache works with WSUS and Configuration Manager, not with Windows Update or Windows Update client policies; Delivery Optimization works with all four.22 Once updates come from Intune, BranchCache no longer carries them.DoctorDO’s reading
  • BranchCache discovery stops at the subnet; Delivery Optimization in Group mode can span subnets and sites.119

04

Peer Cache

A Configuration Manager feature with no dependency on BranchCache: chosen clients serve content from their client cache to the rest of their boundary group.

Deploy the Enable as peer cache source client setting to a collection, and its members become peer cache sources. Other clients need nothing: the management point adds sources that hold the content and are online to the list of content locations it returns. Sources report what they cache to the management point in state messages.12

Fig. 3 · Peer Cache in a branch boundary groupSources cross the WAN; the rest stay local.
Peer Cache: designated clients serve the rest of their boundary groupHEAD OFFICEBRANCH BOUNDARY GROUPHead office DPManagement pointPeer cache sourcesChosen clientsClientsover the WANfallbackTCP 8003peers listed first
Peer cache sources download from the distribution point across the WAN and report what they hold to the management point. It lists them first when another client in the same boundary group asks, and that client downloads from a source. A distribution point is still the fallback.
Describe this diagram

Peer cache sources download from the distribution point across the WAN and report what they hold to the management point. It lists them first when another client in the same boundary group asks, and that client downloads from a source. A distribution point is still the fallback.

Places

  • Head office: Head office DP, Management point
  • Branch boundary group: Peer cache sources, Clients

Parts

  • Head office DP (Configuration Manager distribution point)
  • Management point (policy source)
  • Peer cache sources: Chosen clients
  • Clients

Connections

  • Head office DP → Peer cache sources: Configuration Manager content, active (over the WAN)
  • Head office DP → Clients: Configuration Manager content, idle (no bytes) (fallback)
  • Peer cache sources → Clients: Peer Cache transfer, active (TCP 8003)
  • Management point → Clients: Control, no content (peers listed first)

Requirements and limits

  • A source must be a domain-joined Configuration Manager client; a client that isn’t domain-joined can still download from one. Windows on Arm64 is supported as neither.12
  • Clients use only sources in their current boundary group. A client that falls back to a neighbour group is offered that group’s distribution points, not its peers.12
  • Allow peer downloads in this boundary group must be on, which it is by default, in every boundary group the client is in.413
  • Sources serve on TCP 8003, HTTP or HTTPS, and Configuration Manager opens it in Windows Firewall; any other firewall needs its own rule. In Windows PE, a task sequence first broadcasts for a source on UDP 8004.5
  • A source refuses a request in low battery mode, above 80% processor load, with an average disk queue length over 10, or with no connections left.12
  • Keep sources few. Microsoft calls Peer Cache ideal for special circumstances, such as a remote office with a few employees, and warns that too many sources can cause performance issues in the site and its SQL database.2
  • With the hierarchy setting to divide content into parts, sources each fetch a different part across the WAN and then fill in from each other. It applies to downloads in the background, such as required deployments.12

05

Connected Cache on a distribution point

The bridge between the two: a Delivery Optimization cache that runs on a distribution point you already have.

Configuration Manager can install a Microsoft Connected Cache server on an on-premises distribution point. It is an on-demand, transparent cache for content that Delivery Optimization downloads, stored apart from the distribution point’s own content. Clients set to use it ask it for Microsoft’s cloud content instead of the internet, and if it doesn’t answer they download from the CDN.14

It serves cloud-managed content only: co-managed devices whose workloads have moved to Intune, and devices managed by Intune alone. It does not serve deployments that start in Configuration Manager, such as software updates through a software update point.14

Fig. 4 · Connected Cache on a distribution pointDrawn as a Connected Cache: that is what serves the bytes.
Connected Cache on a distribution point: Delivery Optimization fills from a cache in the branchHEAD OFFICEBOUNDARY GROUPGROUP ID FROM THE BOUNDARY GROUPMicrosoft CDNConfigMgrClient settingsConnected CacheOn the branch DPDevicesCo-managedPeersfills on demandTCP 7680fallbackcache server
Configuration Manager client settings point co-managed devices at the Connected Cache on their distribution point. The cache fills from Microsoft’s CDN the first time content is requested and serves later requests itself; devices can also take pieces from peers in their group, and use the CDN directly only if the cache fails.
Describe this diagram

Configuration Manager client settings point co-managed devices at the Connected Cache on their distribution point. The cache fills from Microsoft’s CDN the first time content is requested and serves later requests itself; devices can also take pieces from peers in their group, and use the CDN directly only if the cache fails.

Places

  • Head office: ConfigMgr
  • Boundary group: Connected Cache, Devices, Peers
  • Group ID from the boundary group: Devices, Peers

Parts

  • Microsoft CDN (internet source)
  • ConfigMgr (policy source): Client settings
  • Connected Cache (connected cache server): On the branch DP
  • Devices: Co-managed
  • Peers

Connections

  • Microsoft CDN → Connected Cache: HTTP download, active (fills on demand)
  • Connected Cache → Devices: Connected Cache, active
  • Peers → Devices: Group peering, active (TCP 7680)
  • Microsoft CDN → Devices: HTTP download, idle (no bytes) (fallback)
  • ConfigMgr → Devices: Policy (cache server)

What it needs

  • An on-premises distribution point on a supported Windows Server, with .NET Framework 4.8 or later and the default web site on port 80. No other site system role on that server, and don’t preinstall IIS Application Request Routing.14
  • A Windows Enterprise E3 or E5, Education A3 or A5, or VDA E3 or E5 licence for each device that gets content from it.14
  • The client setting Enable devices managed by Configuration Manager to use Microsoft Connected Cache servers for content download.5
  • For Intune Win32 apps: the client and the distribution point in the same boundary group (a neighbour or site default group doesn’t count), and the Client apps workload on Pilot Intune or Intune. Intune is moving Win32 app downloads to HTTPS region by region from 16 June 2026; that needs the latest Connected Cache (KB33247081 for versions 2409, 2503, 2509 and 2603, or version 2603) and a certificate from a CA the clients trust on the server’s IIS HTTPS binding. Other cloud content needs no certificate.14
  • For devices managed by Intune alone: DOCacheHost set to the distribution point’s FQDN or IP address.14
  • Peering is optional: the cache works without the Delivery Optimization peer settings.14

To check it is working, look for BytesFromCacheServer in Get-DeliveryOptimizationStatus.14 DoctorDO counts those bytes as Connected Cache, the blue in every chart.DoctorDO’s reading

Which Connected Cache is current

There are two Connected Cache products for organisations, both generally available. Connected Cache in Configuration Manager, on a distribution point, has been generally available since version 211115 and is still maintained: its latest update applies to versions 2409, 2503, 2509 and 2603.14

Microsoft Connected Cache for Enterprise and Education is a standalone cache, created and managed in the Azure portal, deployed to Windows Server 2022 or later, Ubuntu 24.04, or a Windows 11 client in a small branch, and pointed to by Delivery Optimization policy from a tool such as Intune.1516 Microsoft describes it as the cache for customers moving towards modern management and away from distribution points, and names a decommissioned distribution point as hardware it can reuse.1516

06

Moving workloads to Intune

Co-management moves workloads one at a time. Content for a workload that moves comes through Delivery Optimization from Microsoft’s cloud; what you still deploy from Configuration Manager keeps coming from your distribution points.
What changes when a co-management workload moves to Intune
WorkloadAfter the moveCheck
Windows Update policiesWindows Update client policies (formerly Windows Update for Business) from Intune; updates come from Windows Update, through Delivery Optimization.2314Change the Configuration Manager client settings to turn off its software update workflow for these devices.23
Client appsIntune apps in the Company Portal; Win32 apps download through Delivery Optimization. Apps you deploy from Configuration Manager stay in Software Center, on distribution points.2317A Connected Cache on the distribution point can serve the Win32 apps.14
Office Click-to-Run appsMicrosoft 365 Apps from Intune; their installs and updates can use Delivery Optimization.2317Delivery Optimization can’t deliver Microsoft 365 Apps updates while Configuration Manager manages them through Office COM.2

Before you move a workload

  1. Know each device’s effective download mode. The client setting Use Configuration Manager Boundary Groups for Delivery Optimization Group ID sets Group mode (2) and the Group ID;5 Intune or Group Policy may set them too. Set Delivery Optimization from one place, and remove any download mode 100 left from BranchCache.DoctorDO’s reading See download modes.
  2. Map Group IDs to boundary groups on purpose. With that setting on, each boundary group gets its own ID, and a client that roams is given the new one by its management point.2 Allow peer downloads in this boundary group must be on in every boundary group a device is in, or the Group ID is not set at all. Turn it off for a boundary group that spans distant places, such as a VPN, so it doesn’t become one peer group.4 See Group IDs.
  3. Open TCP 7680 between peers, and UDP 3544 where Group mode crosses NATs.19 A rule made for Peer Cache, on TCP 8003, does not cover it.5 See Firewall rules.
  4. Let devices reach the DO cloud service. Peering and Connected Cache both depend on it.17 A proxy that inspects its TLS stops peering, and every download falls back to the CDN.24 See proxy requirements.
  5. Decide what happens on VPN. By default Delivery Optimization doesn’t peer when it detects a VPN, and a separate policy decides whether devices may use a Connected Cache over one.19 With a split tunnel, sending Microsoft’s content endpoints outside the tunnel keeps remote devices off the head-office link.DoctorDO’s reading

Your estate’s delivery by site in OverviewHow DoctorDO finds a Group ID mismatchFirewall rules

Microsoft documentation

References

  1. 1Fundamental concepts for content management in Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management
  2. 2Software update content delivery with Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/sum/deploy-use/optimize-windows-10-update-delivery
  3. 3Overview of boundaries and boundary groups (opens in a new tab)learn.microsoft.com/intune/configmgr/core/servers/deploy/configure/define-site-boundaries-and-boundary-groups
  4. 4Boundary group options (opens in a new tab)learn.microsoft.com/intune/configmgr/core/servers/deploy/configure/boundary-group-options
  5. 5About client settings in Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/clients/deploy/about-client-settings
  6. 6Ports used in Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/ports
  7. 7Support for Windows features and networks in Configuration Manager (BranchCache) (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/configs/support-for-windows-features-and-networks
  8. 8Configure BranchCache for Windows client updates (opens in a new tab)learn.microsoft.com/windows/deployment/update/waas-branchcache
  9. 9BranchCache (opens in a new tab)learn.microsoft.com/windows-server/networking/branchcache/branchcache
  10. 10Configure firewall rules to allow BranchCache traffic (opens in a new tab)learn.microsoft.com/windows-server/networking/branchcache/deploy/configure-firewall-rules-for-non-domain-members-to-allow-branchcache-traffic
  11. 11Service overview and network port requirements for Windows (BranchCache) (opens in a new tab)learn.microsoft.com/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements
  12. 12Peer cache for Configuration Manager clients (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/client-peer-cache
  13. 13Configure peer cache for Configuration Manager clients (opens in a new tab)learn.microsoft.com/troubleshoot/mem/configmgr/content-management/configure-peer-cache
  14. 14Microsoft Connected Cache with Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/microsoft-connected-cache
  15. 15What is Microsoft Connected Cache? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache
  16. 16Microsoft Connected Cache for Enterprise and Education overview (opens in a new tab)learn.microsoft.com/windows/deployment/do/mcc-ent-edu-overview
  17. 17What is Delivery Optimization? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization
  18. 18How Delivery Optimization works (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-workflow
  19. 19Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
  20. 20Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
  21. 21Delivery Optimization frequently asked questions (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-faq
  22. 22Optimize Windows update delivery (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-optimize-windows-10-updates
  23. 23Co-management workloads (opens in a new tab)learn.microsoft.com/intune/configmgr/comanage/workloads
  24. 24Using a proxy with Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-proxy