Learn

How Delivery Optimization works

Windows downloads updates and apps in pieces, from Microsoft’s CDN, from a Connected Cache and from other devices that already have them. What decides which, and what DoctorDO measures.

The parts

Delivery Optimization is an HTTP downloader with a cloud-managed service that lets Windows devices get the same content from alternative sources, such as other devices on the network or a dedicated cache server.¹

Fig. 1 · Who talks to whomThe cloud service matches peers; bytes never pass through it.

Delivery Optimization serviceRuns each download, keeps a cache of pieces, serves pieces to peers.DoSvc, on every device
Cloud serviceLocates the device, hands out configuration and content policy, and matches peers.²*.do.dsp.mp.microsoft.com
HTTP sourceUsually Microsoft’s CDN; a WSUS or other internal web server where one serves the content. Always available, and the cost you are trying to reduce.²Internet (or your network, for an internal server)
Microsoft Connected CacheA software-only cache that serves Microsoft content inside your network.⁶Your network
PeersOther devices with the same content, reached on TCP 7680.²LAN, group, or internet

Content that uses it

Windows updates, Microsoft Defender definition updates, Store apps, Microsoft Edge, Microsoft 365 Apps, Intune Win32 apps and Teams, among others. Some content types use only HTTP or only part of the peer and cache options; Microsoft’s table lists which.¹

One download, step by step

Fig. 2 · One download, in five stepsStep through it, or see all steps at once.

The app asks Delivery OptimizationAn application (Windows Update, the Store, Intune, Edge) hands the download to the Delivery Optimization service, DoSvc.
The cloud returns policy, metadata and peersThe cloud service locates the device and returns its configuration and the content’s policy. DoSvc fetches the content’s hash file, one SHA-256 hash for each piece of about 1 MB, and checks it against a hash it gets from the cloud service over TLS; if that fails, the download falls back to simple HTTP. Peer matching returns devices with the same content in the same peer group: matched by content, then Group ID, then external IP and location.²
Pieces arrive in parallelPieces download at the same time from peers on TCP 7680, a Connected Cache and the CDN. Each piece can come from a different source, and the CDN is always there as the fallback.²
Every piece from a peer is checkedEach piece is checked against its hash in the hash file before it is used. A bad piece is discarded, and a peer that sends several is banned for the next few hours.²
The device becomes a sourceA verified piece is stored in the device’s cache, where other peers can fetch it. The file stays there until it ages out: 3 days by default.²³

Download modes

DODownloadMode decides which sources a device may use besides Microsoft’s servers. It is the first thing to check on any device.

Fig. 3 · Who each mode peers withThe same offices in every tile; filled dots are peers.

0HTTP only, no peering
Peers
None
DO cloud
Yes, for metadata
Sources
CDNConnected Cache
Still uses DO cloud metadata
1LAN — peering behind the same NAT
Peers
Behind the same public IP
DO cloud
Yes
Sources
CDNConnected Cachepeers
2Group — peering across a private group
Recommended by Microsoft³
Peers
Same Group ID: a private group that can span subnets and offices
DO cloud
Yes
Sources
CDNConnected Cachepeers
3Internet peering
Peers
Also internet peers outside your organisation
DO cloud
Yes
Sources
CDNConnected Cachepeers
99Simple — HTTP only, no DO cloud service
Peers
None
DO cloud
No
Sources
CDNConnected Cache
100Bypass (uses BITS)
Deprecated
Peers
None
DO cloud
No (BITS instead)
Sources
BITS, not Delivery Optimization
Deprecated in Windows 11; documented as able to cause content to fail to download

your devicepeer behind the same public IPpeer in another office, same Group IDinternet peernot a peer in this mode

Values and meanings from the reference and the Policy CSP.³⁴

./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/DODownloadMode

Group (2) is the mode Microsoft recommends for most organisations.³ How groups are formed is on the Group IDs page.
To turn peering off, use 0. Bypass (100) is deprecated in Windows 11 and can make some content fail to download.³
99 stops the device using the cloud service at all, for offline environments.³

Where the bytes come from

Windows reports five sources per download. DoctorDO keeps them separate everywhere, in the same colours.

Fig. 4 · Illustration: one file, piece by pieceChoose a source to find its pieces.

A 60 MB file: 60 pieces of about 1 MB, in file orderpiece 1 → 60

The same pieces, added up by source

Windows reports as BytesFromHttpWindows adds up as BytesFromPeers

Byte sources
Source	Reported as	Network cost
HTTP source (usually Microsoft’s CDN)	`BytesFromHttp`	Internet egress, unless the source is an internal server: what you are reducing
Connected Cache	`BytesFromCacheServer`	Inside your network
LAN peers	`BytesFromLanPeers`	Local network
Group peers	`BytesFromGroupPeers`	Local, or WAN if the group spans sites
Internet peers	`BytesFromInternetPeers`	Internet; usually unwanted in an enterprise

Field names from Get-DeliveryOptimizationStatus;⁵ the cost column is DoctorDO’s.DoctorDO’s reading

Fig. 5 · Illustration: DUB-L-00001, a fictitious deviceSources in, peers served out. Select a source for its detail.

Where it gets data

Where it shares

Who can be a peer

Fig. 6 · Who can be a peerChoose a mode and a restriction.

Download mode

LAN (1)Group (2)Internet (3)

Restrict peer selection

None (0)Subnet mask (1)Local Peer Discovery (2)

Either restriction stops peering across subnets.

5 of 10 other devices can be peers: the five other devices in office A, behind the same public IP, whatever their Group ID. The DO cloud service matches them.

yousame officeother office, same groupinternetdifferent Group IDnot a peer

The download mode sets the widest pool: the same public IP in LAN mode, the same Group ID in Group mode, anyone in Internet mode. DORestrictPeerSelectionBy can narrow LAN and Group mode to the device’s own subnet, either by subnet mask or by Local Peer Discovery over DNS-SD; on Windows 11, LAN mode restricts peers to the local subnet by default.³

A device is offered peers by the cloud service and then connects to them on TCP 7680; in Group and Internet mode, devices behind different NATs need Teredo on UDP 3544.⁷ The Firewall rules page has the full list. A device also has to meet these thresholds before it takes part.

Settings that decide whether a device peers
Policy	What it controls	Default when not set
`DOMinFileSizeToCache`	Smallest file that is peered at all	50 MB
`DOMaxCacheAge`	How long a downloaded file stays available to peers	3 days
`DOMaxCacheSize`	Cache size, as a share of available disk space	20%
`DOMinRAMAllowedToPeer`	Memory a device needs before it uploads to peers	4 GB
`DOMinDiskSizeAllowedToPeer`	Disk size a device needs before it uploads to peers	32 GB
`DOMinBatteryPercentageAllowedToUpload`	Battery level needed to upload on battery	No uploads on battery

Defaults from the Delivery Optimization reference.³

What “efficiency” means here

These are DoctorDO’s definitions, not Microsoft metrics. Every ratio is weighted by volume: one device that downloaded 40 GB counts for more than thirty that downloaded 200 MB.

Fig. 7 · Delivery efficiency, worked throughThe same 60 MB file as Fig. 4.

Peer + cache bytes · Connected Cache, LAN, Group, Internet peers45 MB

All bytes · every source, the CDN included60 MB

75%delivery efficiency

Delivery efficiencyDoctorDO’s reading
(peer + cache bytes) ÷ all bytes
How much came from peers and Connected Cache instead of the HTTP source. The headline figure. Internet peers count here, though their bytes still cross the internet; Microsoft’s WUfB bandwidth savings leave them out.
75%
Peer efficiencyDoctorDO’s reading
peer bytes ÷ all bytes
Peering alone, for estates without a Connected Cache.
50%
CDN dependencyDoctorDO’s reading
HTTP bytes ÷ all bytes
The share that still came from the HTTP source, usually Microsoft’s CDN. The number that should shrink.
25%

Why peering fails: three stages

Splitting discovery from connection is what turns “peering is bad” into a specific fix.DoctorDO’s reading

Stage 1 · Discovery
No peers offered
Fails at: The cloud service is not matching the device
Usual causes: Service unreachable, mode 0 or 99, wrong Group ID, or the device is alone in its group
Stage 2 · Connection
Peers offered, none connected
Fails at: Peers cannot reach each other
Usual causes: TCP 7680 blocked, host firewall, wireless client isolation, NAT traversal in Group or Internet mode
Stage 3 · Transfer
Peers connected, little transferred
Fails at: Peers do not have useful content
Usual causes: Cache too small or too short-lived, or the minimum file size excludes the content

Your estate’s efficiency in Overview Per-device flows in Devices

Microsoft documentation

References

1What is Delivery Optimization? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization
2How Delivery Optimization works (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-workflow
3Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
4Policy CSP: DeliveryOptimization (opens in a new tab)learn.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization
5Monitor Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-monitor
6Microsoft Connected Cache overview (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache
7Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
8Delivery Optimization frequently asked questions (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-faq