Skip to content
DoctorDO

Delivery Optimization settings in Intune, one by one.

Delivery Optimization settings in Intune decide where Windows devices get updates and apps: a peer, a Microsoft Connected Cache, or Microsoft’s CDN. This guide builds the profile in the settings catalog, then takes each setting in turn, with its CSP name, its values, Microsoft’s default, and where to start.

By Maurice Daly, Microsoft MVP since 2017 and co-founder of MSEndpointMgr. Shaped with endpoint management practitioners from the MSEndpointMgr community. Checked against Microsoft Learn on 19 October 2026.

Statements marked DoctorDO’s reading are DoctorDO’s own reading of the evidence. Everything else is Microsoft’s documentation, numbered beside it and listed at the end of the page.

1 · Create the profile

Delivery Optimization in the settings catalog, step by step.

  1. In the Microsoft Intune admin center, go to Devices > Manage devices > Configuration > Create > New policy.
  2. Choose Windows 10 and later and the profile type Settings catalog, then name the profile.
  3. Under Configuration settings, select Add settings and pick a category to list its settings.1
  4. Choose the Delivery Optimization category.2

Each setting carries its CSP name, spaced out: DODownloadMode is DO Download Mode, and a name pasted into the picker’s search finds it.2 A setting you add is configured at once with the operating system’s default; the minus sign takes it out again.1

The other route is the profile type Templates > Delivery Optimization. Since April 2025 it builds profiles in the settings catalog’s format, and existing profiles in the old format still work.3 The old format has its own names: Cache server host names rather than DO Cache Host,4 and a cache age in days.5

DoctorDO’s reading Keep to one Delivery Optimization profile per group of devices: two profiles that set one setting to different values conflict.1

2 · Download mode and Group ID

DODownloadMode first, then the group.

Download mode and Group ID
Setting (CSP)ValuesMicrosoft’s defaultStarting point
DODownloadMode0 HTTP only, 1 LAN, 2 Group, 3 Internet, 99 Simple; 100 Bypass is deprecated in Windows 116Pages differ: LAN (1) in the reference,7 0 in the CSP61 or 2 to peer, 0 not to.8 Group suits most organisations7
DOGroupIdA GUID6Not set; used in Group mode only7Optional, and not needed by most estates7
DOGroupIdSource1 AD site, 2 domain SID, 3 DHCP option 234, 4 DNS suffix, 5 Entra tenant ID7Not set: AD site, then domain SID, then tenant ID7DoctorDO’s reading Leave unset unless the default groups the wrong devices together

DoctorDO’s reading The two defaults describe different things: what the client does with no policy, and the value the CSP reports. Get-DOConfig shows what is in force.

Group ID and its source apply in Group mode only, DOGroupId overrides DOGroupIdSource, and a source outside 0 to 5 is ignored.7 The full guide is Group IDs, in the demo.

3 · Which devices peer

Peer selection, RAM, disk, file size, and battery.

Which devices and files take part in peering
Setting (CSP)ValuesMicrosoft’s defaultStarting point
DORestrictPeerSelectionBy0 None, 1 Subnet mask, 2 Local discovery (DNS-SD)6Pages differ: see below1 with LAN mode where several subnets share a NAT8
DOMinRAMAllowedToPeer1 to 100,000 GB64 GB71 to 4 GB;7 4 GB in Intune’s reference5
DOMinDiskSizeAllowedToPeer1 to 100,000 GB632 GB7Pages differ: 64 to 256 GB,7 or 32 GB5
DOMinFileSizeToCache1 to 100,000 MB650 MB710 MB above 30 devices, 1 MB above 1008
DOMinBatteryPercentageAllowedToUpload0 to 100%6No uploads on battery7Pages differ: 40%,75 or 60%8

DORestrictPeerSelectionBy has three documented defaults. The CSP says 0, None.6 The reference says LAN mode on Windows 11 restricts peers to the local subnet by default.7 The testing guide says the Windows 11 default is 2, Local Peer Discovery.9 DoctorDO’s reading Set it explicitly on Windows 11 rather than rely on any of them.

4 · The device’s cache

Cache size, age, and drive.

The Delivery Optimization cache on each device
Setting (CSP)ValuesMicrosoft’s defaultStarting point
DOMaxCacheSize1 to 100% of free space620%7DoctorDO’s reading The default, unless disks are small
DOAbsoluteMaxCacheSizeGB; overrides DOMaxCacheSize7Not configured7DoctorDO’s reading Set one of the two size limits, not both
DOMaxCacheAgeSeconds; 0 keeps files indefinitely7259,200 (3 days)7604,800 (7 days), up to 30 days, where devices stay on with free disk8
DOModifyCacheDriveEnvironment variable, drive letter, or path7%SYSTEMDRIVE%7DoctorDO’s reading The default, unless a second drive is roomier

5 · Bandwidth

Foreground, background, and business hours.

Download bandwidth
Setting (CSP)ValuesMicrosoft’s defaultStarting point
DOPercentageMaxForegroundBandwidth0 to 100%60, adjusting dynamically7DoctorDO’s reading 0, unless downloads crowd out other traffic
DOPercentageMaxBackgroundBandwidth0 to 100%60, adjusting dynamically7DoctorDO’s reading As foreground
DOMaxForegroundDownloadBandwidthKB/s60, adjusting dynamically7Absolute limits, rather than percentages, on low-bandwidth links78
DOMaxBackgroundDownloadBandwidthKB/s60, adjusting dynamically7As foreground7
DOSetHoursToLimitForegroundDownloadBandwidthBusiness hours, and a percentage inside and outside them6Not configured7DoctorDO’s reading Where daytime traffic needs protecting
DOSetHoursToLimitBackgroundDownloadBandwidthAs foreground6Not configured7DoctorDO’s reading As foreground
DOMinBackgroundQosKB/s6Pages differ: 20 MB/s,7 in a KB/s setting whose CSP default is 06Below the network’s average speed: 500 KB/s where it’s 1,0008

A business-hours setting takes precedence over the matching percentage, and an absolute limit makes the percentages a share of it. The percentage limits leave LAN peers alone.7 DOMaxDownloadBandwidth, DOPercentageMaxDownloadBandwidth and DOMaxUploadBandwidth are deprecated since Windows 10, version 2004.7

6 · Fallback delays

HTTP and cache-server delays: how long to wait.

How long to wait before falling back to HTTP
Setting (CSP)ValuesMicrosoft’s defaultStarting point
DODelayBackgroundDownloadFromHttpSeconds6Not configured760 seconds85
DODelayForegroundDownloadFromHttpSeconds6Not configured7Pages differ: 30 seconds,8 or 605
DODelayCacheServerFallbackBackground0 to 2,592,000 seconds6Not configured,7 or 06Higher than the HTTP delay8
DODelayCacheServerFallbackForeground0 to 2,592,000 seconds6Not configured,7 or 06Higher than the HTTP delay8

While a device waits for a peer, the download appears stuck to the user.5 The configuration guide says the HTTP and cache-server timers both start with the download and aren’t additive;8 the reference says the HTTP delay applies first.7 Under both readings a cache delay above the HTTP delay gives the cache its time.

Autopilot is the exception: Microsoft says to set the foreground HTTP delay to 0 and the background one to 0 or a low value.10 DoctorDO’s reading A provisioning profile apart from the everyday one keeps both right; see Intune Win32 apps and Delivery Optimization.

7 · Cache servers and VPN

DOCacheHost, DOCacheHostSource, and VPN peering.

Connected Cache servers and VPN
Setting (CSP)ValuesMicrosoft’s defaultStarting point
DOCacheHostFQDNs or IP addresses, separated by commas7No value7Your cache servers; any value counts as set7
DOCacheHostSource1 DHCP option 235, 2 option 235 Force7No value7Set with DOCacheHost for devices that leave the site8
DOAllowVPNPeerCaching0 not allowed, 1 allowed6No peering on VPN, except with Local discovery7DoctorDO’s reading Off, unless VPN users share a site
DOVpnKeywordsKeywords, separated by commas6“VPN”, “Secure”, “Virtual Private Network” in the adapter’s name7Add your VPN adapter’s name if none matches8
DODisallowCacheServerDownloadsOnVPN0 not set, 1 enabled6Cache downloads allowed on VPN71 if remote devices should use the internet instead7

With both cache settings, source 1 leaves DOCacheHost in charge and only 2 (Force) lets DHCP option 235 win.7 Microsoft’s pages describe a list of several cache servers three ways: tried in turn until one connects,6 used at once in round robin,7 or in the order listed.8 Placement and fallback are in Microsoft Connected Cache with Intune.

8 · Checking a device

Did the device get the settings?

In Intune, open the profile and select View report; per-setting status counts the devices that applied each setting, or hit a conflict or an error, and Devices > Monitor > Assignment failures lists the failures.1

On the device, Get-DOConfig -Verbose lists each policy with its value and the provider that set it, such as Mdm Provider, or Default Provider for the platform default. Get-DODownloadMode gives the mode in use, and Get-DeliveryOptimizationStatus each download’s.11

PowerShell · one device, elevated
# Every Delivery Optimization policy in force, and the provider that set it
Get-DOConfig -Verbose

# The download mode the device is using now
Get-DODownloadMode

# Each current download, with its mode and where its bytes came from
Get-DeliveryOptimizationStatus |
  Select-Object FileId, DownloadMode, Priority, BytesFromPeers, BytesFromHttp

The CSP names HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization as the registry key behind each setting’s Group Policy mapping.6 DoctorDO’s reading Values Intune sets aren’t necessarily there, so an empty key doesn’t mean no policy. Beside that key and Get-DOConfig, DoctorDO’s collector reads HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization, where MDM values are seen but which Microsoft doesn’t document, and shows each device’s values with who set them. What is collected lists the keys.

What DoctorDO checks in these settings
  • DO-BASE-001, DO-BASE-002A value, or an unset default, that doesn’t suit your kind of environment.
  • DO-BASE-005Group Policy and MDM both set the same setting.
  • DO-POL-001, DO-POL-002, DO-POL-003Group ID settings that are ignored.
  • DO-POL-010A Group ID source that Entra-joined devices don’t have.
  • DO-POL-004, DO-POL-005, DO-POL-006Both cache size limits set, a moved cache drive, or a cache age of 0.
  • DO-POL-007, DO-POL-008VPN peering and VPN detection that don’t match the estate.
  • DO-MCC-001, DO-MCC-003DHCP option 235 never used, or a cache delay no higher than the HTTP delay.
  • DO-POL-009Delays that can hold up Autopilot provisioning.
  • DO-POL-011Co-managed devices that take their settings from Configuration Manager.

DoctorDO is an independent community project, in preview, and changes no Delivery Optimization setting on your devices. When the settings are right and peering still fails, the troubleshooting checklist goes on from here.

See a device’s settings in the demo

Questions

Intune settings, briefly.

Settings catalog or the Delivery Optimization template?

Either: since April 2025 the template builds profiles in the settings catalog’s format.3 The catalog can also hold Delivery Optimization beside other settings.1

Why does a setting show a value I didn’t choose?

A setting added from the picker is configured at once, with the operating system’s default. Its minus sign removes it, the same as Not configured.1

Is the cache age in days or in seconds?

In seconds, as the CSP defines it.6 Only the template from before 24 April 2025 asks for days, and converts them: 3 days arrives on the device as 259,200 seconds.5

Which download mode should I set in Intune?

Microsoft calls Group (2) the recommended option for most organisations,7 and LAN (1) defines a peer group of the devices behind one NAT.8 To turn peering off, set 0, never the deprecated 100.7

Can I try DoctorDO now?

DoctorDO is in preview. The first public release is coming. Until then, the live demo shows a fictitious company’s Delivery Optimization settings, device by device, with who set each one.

The other guides, and the Learn page’s essentials, each with Microsoft’s documentation.

All 11 Microsoft pages cited on this page
  1. 1Use the Intune settings catalog to configure settings (opens in a new tab)learn.microsoft.com/intune/device-configuration/settings-catalog/
  2. 2Delivery Optimization (Intune school deployment settings) (opens in a new tab)learn.microsoft.com/intune/solutions/education/tutorial-school-deployment/ref-delivery-optimization-settings-windows
  3. 3Delivery Optimization settings in Microsoft Intune (opens in a new tab)learn.microsoft.com/intune/device-configuration/templates/configure-delivery-optimization-windows
  4. 4Microsoft Connected Cache with Configuration Manager (opens in a new tab)learn.microsoft.com/intune/configmgr/core/plan-design/hierarchy/microsoft-connected-cache
  5. 5Delivery Optimization settings for Windows devices in Intune (opens in a new tab)learn.microsoft.com/intune/device-configuration/templates/ref-delivery-optimization-settings-windows
  6. 6Policy CSP: DeliveryOptimization (opens in a new tab)learn.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization
  7. 7Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
  8. 8Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
  9. 9Testing Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-test
  10. 10Microsoft Connected Cache for Enterprise and Education overview (opens in a new tab)learn.microsoft.com/windows/deployment/do/mcc-ent-edu-overview
  11. 11Monitor Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-monitor

Every device’s settings, and who set them.

The live demo shows ContosoAI’s Delivery Optimization settings device by device, with who set each one. Every company, site, and figure in ContosoAI is invented; the problems are ones met in real estates. Its figures are modelled, not computed from collector reports. DoctorDO is in preview.