Intune Win32 apps, peer to peer.

Each Win32 app assignment has a Delivery optimization priority in its app settings: download the content in background or in foreground mode.⁴ Left alone, the value is notConfigured, which Microsoft Graph describes as “not configured or background normal delivery optimization priority”.⁵

Delivery Optimization treats the two apart: each has its own HTTP delay,⁶ and by default a background download targets no more than 45% of the available bandwidth, a foreground one 90%.⁷ On the device, Get-DeliveryOptimizationStatus shows each job’s Priority.⁸

DoctorDO’s reading Foreground suits apps someone is waiting for, such as those the Enrollment Status Page blocks on; background suits large apps that can arrive over hours.

• It’s waiting for a peer

  DODelayForegroundDownloadFromHttp and DODelayBackgroundDownloadFromHttp make a download that can use peers wait for one before it uses the HTTP source, and meanwhile “the download appears to be stuck for the end user”. Neither is set by default; Intune’s reference recommends 60 seconds.⁶ With a cache server configured, two more delays hold back the fallback from the cache to the CDN.⁹

• It’s too small to peer

  Unless you change DOMinFileSizeToCache, only files of 50 MB or more are peered. Below that size Delivery Optimization switches to Simple mode by itself: HTTP from the original source or a Connected Cache, with no peers.¹⁰ Microsoft suggests 10 MB for an estate of more than 30 devices, and 1 MB above 100.¹¹

• The port is closed

  Peers share content on TCP 7680, which the service opens itself; block it and peering stops, while downloads carry on over 80 and 443. UDP 3544 (Teredo) matters only in Group (2) or Internet (3) mode, for peers behind different NATs.¹¹

• The mode, a VPN, or the battery rules peers out

  HTTP only (0) and Simple (99) never peer, and LAN (1) peers only behind the same public IP.¹⁰ By default there’s no peering over a VPN that Delivery Optimization detects, or on battery.¹¹

• A proxy breaks the pieces

  The Intune Management Extension’s endpoints must allow HTTP partial responses.³ A proxy that strips byte-range requests makes the client download whole files, and peer sharing stops.¹²

DoctorDO’s reading When a Win32 app sits at the same percentage, look at the HTTP delays first. When peers connect but little comes from them, look at the minimum file size and the cache.

The Enrollment Status Page (ESP) tracks Win32 apps in two phases: those assigned to the device in device setup, and those assigned to the user in account setup. Before either, during device preparation, the device installs the Intune Management Extension that installs them.¹³

The page shows an error when installation takes longer than its time-out, 60 minutes by default.¹³ Microsoft’s troubleshooting guide says an ESP time-out during app deployment usually means the time-out is too short for every required app.¹⁴ Since Intune 2308 a Win32 app can have its own installation time too, and a longer one needs a longer ESP time-out.¹⁵

Don’t mix line-of-business (MSI) and Win32 apps under the ESP: both use TrustedInstaller, so the Win32 install fails and the ESP with it. Windows Autopilot device preparation doesn’t use the ESP, and supports mixing them.¹³

Content downloaded during the ESP can use either priority, so Microsoft says to set the foreground HTTP delay to 0 and the background one to 0 or a low value. Devices being provisioned are transient peers that might not stay online long enough to serve later devices; Connected Cache is the persistent local source.⁹

DoctorDO’s reading That makes a device being provisioned the one most likely to have no peer to wait for, and the one a delay holds up most.

What DoctorDO records

The collector reads what the ESP tracked: for up to 30 Win32 apps, the app’s Intune app ID (never its name), its phase, installation state, reboot flag, and first and last status times. It also sums up what Delivery Optimization downloaded around provisioning, by source and priority, with the 10 largest jobs and their calling app.

The Reporting page ranks the apps by median minutes between the first and last status the ESP logged, which isn’t an install time, and lists opportunities, each marked Measured or Modelled: a foreground HTTP delay, downloads below the peer-caching minimum, an unused Connected Cache, failed apps, or an ESP near the default time-out. It never adds up minutes saved. Rule DO-POL-009 flags a foreground HTTP delay above 0, or a background one of 60 minutes or more, on any device, since DoctorDO can’t tell from a device’s settings whether Autopilot will provision it.

Microsoft Connected Cache for Enterprise and Education supports Win32 apps from Intune on co-managed and cloud-only devices, and Windows Autopilot. Devices use a cache node once the DOCacheHost policy points them to it, and can fall back to the CDN if it’s unavailable.⁹ A Configuration Manager distribution point with Connected Cache can serve Intune Win32 apps to co-managed clients in its boundary group, with the Client apps workload on Pilot Intune or Intune.¹⁶ Connected Cache run by an internet provider doesn’t support Intune Win32 apps.¹⁷

Win32 content is moving to HTTPS

Microsoft’s Configuration Manager documentation says Intune began rolling out HTTPS for Win32 app content on 16 June 2026, region by region; a distribution point then needs the latest Connected Cache and a certificate from a CA the clients trust.¹⁶ A Connected Cache for Enterprise and Education node needs HTTPS set up too, or devices asking for secure URLs bypass it and go to the CDN.¹⁸

DoctorDO’s reading If Win32 bytes still come from the CDN with a cache in place, check the cache’s HTTPS set-up before the devices’ policy.

DoctorDO’s Connected Cache design plans for it: clients reach the cache on TCP 443 for Intune Win32 apps and Teams, once it has a certificate from a CA they trust.

DoctorDO, an independent community project, isn’t part of Intune and never sits in the download path. It names the content behind each download from the host it came from and the app that asked for it. A download from Intune’s Win32 app hosts, swda01-mscdn.manage.microsoft.com and its siblings, is classed as an Intune Win32 app with high confidence by rule CR-HOST-INTUNE-WIN32, which quotes Microsoft’s Intune endpoint list; the Enterprise App Catalog and Intune Management Extension hosts have rules of their own. A job whose calling app is IntuneAppDownload is classed the same way with medium confidence, marked still to be verified, because Microsoft publishes no list of calling apps.

On a device’s page, the content type chart shows how much of its download was Intune Win32 apps, the requesting apps chart shows which callers asked, and the content list shows each file’s bytes from peers, Connected Cache, and the HTTP source.

Microsoft’s own Delivery Optimization report counts Intune Win32 apps in an Intune Apps category, for the whole tenant;¹⁹ DO reports covers that report.

DoctorDO’s reading Per device and per site, a site whose Win32 apps all come from the CDN stands out, where a tenant-wide figure would hide it.