Delivery Optimization settings in Intune, one by one.
Delivery Optimization settings in Intune decide where Windows devices get updates and apps: a peer, a Microsoft Connected Cache, or Microsoft’s CDN. This guide builds the profile in the settings catalog, then takes each setting in turn, with its CSP name, its values, Microsoft’s default, and where to start.
By Maurice Daly, Microsoft MVP since 2017 and co-founder of MSEndpointMgr. Shaped with endpoint management practitioners from the MSEndpointMgr community. Checked against Microsoft Learn on 19 October 2026.
Statements marked DoctorDO’s reading are DoctorDO’s own reading of the evidence. Everything else is Microsoft’s documentation, numbered beside it and listed at the end of the page.
1 · Create the profile
Delivery Optimization in the settings catalog, step by step.
- In the Microsoft Intune admin center, go to Devices > Manage devices > Configuration > Create > New policy.
- Choose Windows 10 and later and the profile type Settings catalog, then name the profile.
- Under Configuration settings, select Add settings and pick a category to list its settings.1
- Choose the Delivery Optimization category.2
Each setting carries its CSP name, spaced out: DODownloadMode is DO Download Mode, and a name pasted into the picker’s search finds it.2 A setting you add is configured at once with the operating system’s default; the minus sign takes it out again.1
The other route is the profile type Templates > Delivery Optimization. Since April 2025 it builds profiles in the settings catalog’s format, and existing profiles in the old format still work.3 The old format has its own names: Cache server host names rather than DO Cache Host,4 and a cache age in days.5
DoctorDO’s reading Keep to one Delivery Optimization profile per group of devices: two profiles that set one setting to different values conflict.1
2 · Download mode and Group ID
DODownloadMode first, then the group.
| Setting (CSP) | Values | Microsoft’s default | Starting point |
|---|---|---|---|
DODownloadMode | 0 HTTP only, 1 LAN, 2 Group, 3 Internet, 99 Simple; 100 Bypass is deprecated in Windows 116 | Pages differ: LAN (1) in the reference,7 0 in the CSP6 | 1 or 2 to peer, 0 not to.8 Group suits most organisations7 |
DOGroupId | A GUID6 | Not set; used in Group mode only7 | Optional, and not needed by most estates7 |
DOGroupIdSource | 1 AD site, 2 domain SID, 3 DHCP option 234, 4 DNS suffix, 5 Entra tenant ID7 | Not set: AD site, then domain SID, then tenant ID7 | DoctorDO’s reading Leave unset unless the default groups the wrong devices together |
DoctorDO’s reading The two defaults describe different things: what the client does with no policy, and the value the CSP reports. Get-DOConfig shows what is in force.
Group ID and its source apply in Group mode only, DOGroupId overrides DOGroupIdSource, and a source outside 0 to 5 is ignored.7 The full guide is Group IDs, in the demo.
3 · Which devices peer
Peer selection, RAM, disk, file size, and battery.
| Setting (CSP) | Values | Microsoft’s default | Starting point |
|---|---|---|---|
DORestrictPeerSelectionBy | 0 None, 1 Subnet mask, 2 Local discovery (DNS-SD)6 | Pages differ: see below | 1 with LAN mode where several subnets share a NAT8 |
DOMinRAMAllowedToPeer | 1 to 100,000 GB6 | 4 GB7 | 1 to 4 GB;7 4 GB in Intune’s reference5 |
DOMinDiskSizeAllowedToPeer | 1 to 100,000 GB6 | 32 GB7 | Pages differ: 64 to 256 GB,7 or 32 GB5 |
DOMinFileSizeToCache | 1 to 100,000 MB6 | 50 MB7 | 10 MB above 30 devices, 1 MB above 1008 |
DOMinBatteryPercentageAllowedToUpload | 0 to 100%6 | No uploads on battery7 | Pages differ: 40%,75 or 60%8 |
DORestrictPeerSelectionBy has three documented defaults. The CSP says 0, None.6 The reference says LAN mode on Windows 11 restricts peers to the local subnet by default.7 The testing guide says the Windows 11 default is 2, Local Peer Discovery.9 DoctorDO’s reading Set it explicitly on Windows 11 rather than rely on any of them.
4 · The device’s cache
Cache size, age, and drive.
| Setting (CSP) | Values | Microsoft’s default | Starting point |
|---|---|---|---|
DOMaxCacheSize | 1 to 100% of free space6 | 20%7 | DoctorDO’s reading The default, unless disks are small |
DOAbsoluteMaxCacheSize | GB; overrides DOMaxCacheSize7 | Not configured7 | DoctorDO’s reading Set one of the two size limits, not both |
DOMaxCacheAge | Seconds; 0 keeps files indefinitely7 | 259,200 (3 days)7 | 604,800 (7 days), up to 30 days, where devices stay on with free disk8 |
DOModifyCacheDrive | Environment variable, drive letter, or path7 | %SYSTEMDRIVE%7 | DoctorDO’s reading The default, unless a second drive is roomier |
5 · Bandwidth
Foreground, background, and business hours.
| Setting (CSP) | Values | Microsoft’s default | Starting point |
|---|---|---|---|
DOPercentageMaxForegroundBandwidth | 0 to 100%6 | 0, adjusting dynamically7 | DoctorDO’s reading 0, unless downloads crowd out other traffic |
DOPercentageMaxBackgroundBandwidth | 0 to 100%6 | 0, adjusting dynamically7 | DoctorDO’s reading As foreground |
DOMaxForegroundDownloadBandwidth | KB/s6 | 0, adjusting dynamically7 | Absolute limits, rather than percentages, on low-bandwidth links78 |
DOMaxBackgroundDownloadBandwidth | KB/s6 | 0, adjusting dynamically7 | As foreground7 |
DOSetHoursToLimitForegroundDownloadBandwidth | Business hours, and a percentage inside and outside them6 | Not configured7 | DoctorDO’s reading Where daytime traffic needs protecting |
DOSetHoursToLimitBackgroundDownloadBandwidth | As foreground6 | Not configured7 | DoctorDO’s reading As foreground |
DOMinBackgroundQos | KB/s6 | Pages differ: 20 MB/s,7 in a KB/s setting whose CSP default is 06 | Below the network’s average speed: 500 KB/s where it’s 1,0008 |
A business-hours setting takes precedence over the matching percentage, and an absolute limit makes the percentages a share of it. The percentage limits leave LAN peers alone.7 DOMaxDownloadBandwidth, DOPercentageMaxDownloadBandwidth and DOMaxUploadBandwidth are deprecated since Windows 10, version 2004.7
6 · Fallback delays
HTTP and cache-server delays: how long to wait.
| Setting (CSP) | Values | Microsoft’s default | Starting point |
|---|---|---|---|
DODelayBackgroundDownloadFromHttp | Seconds6 | Not configured7 | 60 seconds85 |
DODelayForegroundDownloadFromHttp | Seconds6 | Not configured7 | Pages differ: 30 seconds,8 or 605 |
DODelayCacheServerFallbackBackground | 0 to 2,592,000 seconds6 | Not configured,7 or 06 | Higher than the HTTP delay8 |
DODelayCacheServerFallbackForeground | 0 to 2,592,000 seconds6 | Not configured,7 or 06 | Higher than the HTTP delay8 |
While a device waits for a peer, the download appears stuck to the user.5 The configuration guide says the HTTP and cache-server timers both start with the download and aren’t additive;8 the reference says the HTTP delay applies first.7 Under both readings a cache delay above the HTTP delay gives the cache its time.
Autopilot is the exception: Microsoft says to set the foreground HTTP delay to 0 and the background one to 0 or a low value.10 DoctorDO’s reading A provisioning profile apart from the everyday one keeps both right; see Intune Win32 apps and Delivery Optimization.
7 · Cache servers and VPN
DOCacheHost, DOCacheHostSource, and VPN peering.
| Setting (CSP) | Values | Microsoft’s default | Starting point |
|---|---|---|---|
DOCacheHost | FQDNs or IP addresses, separated by commas7 | No value7 | Your cache servers; any value counts as set7 |
DOCacheHostSource | 1 DHCP option 235, 2 option 235 Force7 | No value7 | Set with DOCacheHost for devices that leave the site8 |
DOAllowVPNPeerCaching | 0 not allowed, 1 allowed6 | No peering on VPN, except with Local discovery7 | DoctorDO’s reading Off, unless VPN users share a site |
DOVpnKeywords | Keywords, separated by commas6 | “VPN”, “Secure”, “Virtual Private Network” in the adapter’s name7 | Add your VPN adapter’s name if none matches8 |
DODisallowCacheServerDownloadsOnVPN | 0 not set, 1 enabled6 | Cache downloads allowed on VPN7 | 1 if remote devices should use the internet instead7 |
With both cache settings, source 1 leaves DOCacheHost in charge and only 2 (Force) lets DHCP option 235 win.7 Microsoft’s pages describe a list of several cache servers three ways: tried in turn until one connects,6 used at once in round robin,7 or in the order listed.8 Placement and fallback are in Microsoft Connected Cache with Intune.
8 · Checking a device
Did the device get the settings?
In Intune, open the profile and select View report; per-setting status counts the devices that applied each setting, or hit a conflict or an error, and Devices > Monitor > Assignment failures lists the failures.1
On the device, Get-DOConfig -Verbose lists each policy with its value and the provider that set it, such as Mdm Provider, or Default Provider for the platform default. Get-DODownloadMode gives the mode in use, and Get-DeliveryOptimizationStatus each download’s.11
# Every Delivery Optimization policy in force, and the provider that set it
Get-DOConfig -Verbose
# The download mode the device is using now
Get-DODownloadMode
# Each current download, with its mode and where its bytes came from
Get-DeliveryOptimizationStatus |
Select-Object FileId, DownloadMode, Priority, BytesFromPeers, BytesFromHttpThe CSP names HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization as the registry key behind each setting’s Group Policy mapping.6 DoctorDO’s reading Values Intune sets aren’t necessarily there, so an empty key doesn’t mean no policy. Beside that key and Get-DOConfig, DoctorDO’s collector reads HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization, where MDM values are seen but which Microsoft doesn’t document, and shows each device’s values with who set them. What is collected lists the keys.
What DoctorDO checks in these settings
- DO-BASE-001, DO-BASE-002A value, or an unset default, that doesn’t suit your kind of environment.
- DO-BASE-005Group Policy and MDM both set the same setting.
- DO-POL-001, DO-POL-002, DO-POL-003Group ID settings that are ignored.
- DO-POL-010A Group ID source that Entra-joined devices don’t have.
- DO-POL-004, DO-POL-005, DO-POL-006Both cache size limits set, a moved cache drive, or a cache age of 0.
- DO-POL-007, DO-POL-008VPN peering and VPN detection that don’t match the estate.
- DO-MCC-001, DO-MCC-003DHCP option 235 never used, or a cache delay no higher than the HTTP delay.
- DO-POL-009Delays that can hold up Autopilot provisioning.
- DO-POL-011Co-managed devices that take their settings from Configuration Manager.
DoctorDO is an independent community project, in preview, and changes no Delivery Optimization setting on your devices. When the settings are right and peering still fails, the troubleshooting checklist goes on from here.
Questions
Intune settings, briefly.
Settings catalog or the Delivery Optimization template?
Why does a setting show a value I didn’t choose?
Is the cache age in days or in seconds?
Which download mode should I set in Intune?
Can I try DoctorDO now?
More on Delivery Optimization
The other guides, and the Learn page’s essentials, each with Microsoft’s documentation.
All 11 Microsoft pages cited on this page
- 1Use the Intune settings catalog to configure settings (opens in a new tab)learn.microsoft.com/intune/device-configuration/settings-catalog/
- 2Delivery Optimization (Intune school deployment settings) (opens in a new tab)learn.microsoft.com/intune/solutions/education/tutorial-school-deployment/ref-delivery-optimization-settings-windows
- 3Delivery Optimization settings in Microsoft Intune (opens in a new tab)learn.microsoft.com/intune/device-configuration/templates/configure-delivery-optimization-windows
- 4Microsoft Connected Cache with Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/microsoft-connected-cache
- 5Delivery Optimization settings for Windows devices in Intune (opens in a new tab)learn.microsoft.com/intune/device-configuration/templates/ref-delivery-optimization-settings-windows
- 6Policy CSP: DeliveryOptimization (opens in a new tab)learn.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization
- 7Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
- 8Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
- 9Testing Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-test
- 10Microsoft Connected Cache for Enterprise and Education overview (opens in a new tab)learn.microsoft.com/windows/deployment/do/mcc-ent-edu-overview
- 11Monitor Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-monitor
Every device’s settings, and who set them.
The live demo shows ContosoAI’s Delivery Optimization settings device by device, with who set each one. Every company, site, and figure in ContosoAI is invented; the problems are ones met in real estates. Its figures are modelled, not computed from collector reports. DoctorDO is in preview.