Learn

Group IDs

In Group download mode a device peers with devices that share its Group ID. Where that ID comes from decides whether an office peers with itself, with nobody, or across a paid WAN link.

When a Group ID applies

How each download mode chooses peers
Download mode	Peers with	Group ID
LAN (1)	Devices that reach the internet from the same public IP.¹	Ignored
Group (2)	Devices with the same Group ID. Microsoft calls Group mode the recommended option for most organisations.¹	Used
HTTP only (0), Internet (3), Simple (99)	No peers (0, 99), or internet peers as well (3).²	Ignored

Rules Windows applies

DOGroupId and DOGroupIdSource apply only in Group (2) mode; in any other mode they are ignored.¹
If DOGroupId is set, DOGroupIdSource is ignored.¹
A Group ID is a GUID, set on every device in the group.¹
With neither set, the group is the AD site, then the authenticated domain SID, then the Microsoft Entra tenant ID, in that order.¹
If source 3 (DHCP) or 4 (DNS suffix) fails, that default order is used instead, silently.¹
A DOGroupIdSource value outside 0 to 5 makes Windows ignore the policy entirely.¹

Peer matching goes by content first, then Group ID, then the device’s external IP and location.⁶ The download mode itself is explained in How Delivery Optimization works.

Two ways to set it

A literal Group ID you assign, or a source each device reads the Group ID from. Set one, not both.

Group ID policies
Policy	Intune OMA-URI	Type	Use when
`DOGroupId`	`./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/DOGroupId`	String (GUID)	You decide the groups yourself and assign them per device group.
`DOGroupIdSource`	`./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/DOGroupIdSource`	Integer, 1 to 5	Something you already maintain (AD sites, DHCP, DNS) should decide.
`DODownloadMode`	`./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/DODownloadMode`	Integer, 2 for Group	Always, with either of the above. Without it neither applies.

OMA-URIs from the Policy CSP.²

PowerShell · a new Group ID (one per group, not per device)

(New-Guid).Guid

DOGroupIdSource values

Group ID sources
Value	Source	Devices are grouped by	Watch for
1	AD Site	The device’s Active Directory site.	Only as good as your AD site design: sites that span several offices put them in one group.
2	Authenticated domain SID	The domain the device authenticated to.	One group per domain, usually the whole estate. Spans every WAN link in the domain.
3	DHCP Option ID	The GUID returned by DHCP option 234 on the device’s network.¹	Needs a GUID per scope on every DHCP server, including off-site and VPN pools. Falls back silently if the option is missing.
4	DNS Suffix	The device’s DNS suffix.	Only useful where each site has its own connection-specific suffix. Falls back silently if it cannot be read.
5	Microsoft Entra tenant ID	The Microsoft Entra tenant: every device in the tenant is one group.	One group across every site and every WAN link.

Values and names from Microsoft;¹² the “watch for” column is DoctorDO’s.DoctorDO’s reading Value 0 means not set.

Choosing a Group ID source

Start from what you already maintain. The aim is one group per place where devices share a fast network, and never one group across a WAN link you pay for.

Choosing a Group ID source
Your estate	Use	Why	Source
Configuration Manager with boundary groups that match your sites	Group mode (2) with Group IDs from the boundary groups	Reuses a grouping you already maintain instead of inventing a second one.	³⁴
Domain or hybrid joined, AD sites match physical locations	`DOGroupIdSource` = 1 (AD site)	Existing logical grouping; nothing new to maintain per device.	³
Entra joined only, and you run DHCP at each site	`DOGroupIdSource` = 3, with a GUID in option 234 per site	The network decides the group, so a laptop that moves offices moves group.	DoctorDO’s reading
Entra joined only, and each site has its own DNS suffix	`DOGroupIdSource` = 4 (DNS suffix)	As DHCP, with no new DHCP option to deploy.	DoctorDO’s reading
Entra joined only, no per-site DHCP or DNS you control	A literal `DOGroupId` per site, one Intune profile per site device group	Explicit and auditable. The cost is keeping device groups aligned with sites.	DoctorDO’s reading
One site, or sites joined by links you are happy to peer across	`DOGroupIdSource` = 5 (tenant) or 2 (domain SID), or leave it unset	One group is correct when there is no link to protect. Unset falls back to AD site, then domain SID, then tenant.	¹DoctorDO’s reading
Several subnets behind one NAT, peering should stay inside each subnet	LAN mode (1) with `DORestrictPeerSelectionBy` = 1 (subnet). No Group ID.	Microsoft’s recommendation for exactly this layout.	³
A single flat site on one network	LAN mode (1). No Group ID.	LAN mode already peers among devices behind the same public IP.	¹

Rows marked DoctorDO are our judgement for the estate described, built on the behaviour Microsoft documents. Rows with a number cite Microsoft directly.

Restricting peer selection

DORestrictPeerSelectionBy narrows who a device peers with, inside LAN or Group mode.

DORestrictPeerSelectionBy values
Value	Meaning
0	None
1	Subnet mask
2	Local Peer Discovery (DNS-SD/mDNS)

./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/DORestrictPeerSelectionBy

With Local Discovery (2) the cloud service is not used to find peers,¹ and it is the one option that still peers when Delivery Optimization detects a VPN.¹

How DoctorDO finds a mismatch

The collector reports each device’s effective download mode, Group ID settings and the channel that set them. With -Anonymise, the fleet default, the Group ID is hashed on the device with a salt derived from your tenant, so the console can compare groups across devices without seeing the GUID. Anyone who has your tenant ID can test a guessed Group ID against the hash, as for peer addresses.

Configuration that Windows ignores

Group ID findings from configuration
Rule	Finding	Why it matters
DO-POL-001	Group ID settings configured outside Group mode	Windows ignores them; the next admin reads them as active.
DO-POL-002	`DOGroupIdSource` set while `DOGroupId` is set	The source has no effect.
DO-POL-003	`DOGroupIdSource` outside 0 to 5	The policy is ignored entirely.

Groups that do not match the network

Devices are placed in segments by subnet, AD site, resolved Group ID and hashed egress address, then each segment is checked for agreement.DoctorDO’s reading

Segment cohesion checks
Check	A failure means
One resolved Group ID per office	Devices in the same office are in different groups and will never peer with each other.
One office per Group ID	A group spans sites, so peers may be pulled across a WAN link.
One download mode per segment	Policy is not landing uniformly; some devices cannot peer with the rest.
One egress address per segment	Split egress (VPN, SASE): LAN mode cannot group these devices; Group mode can.

See Group ID findings in Recommendations Each device’s mode and group in Devices

Microsoft documentation

References

1Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
2Policy CSP: DeliveryOptimization (opens in a new tab)learn.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization
3Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
4Delivery Optimization and Microsoft 365 Apps (opens in a new tab)learn.microsoft.com/microsoft-365-apps/updates/delivery-optimization
5Testing Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-test
6How Delivery Optimization works (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-workflow