Intune policies

• △ warning

  Organisation

  DO-EFF-002

  ○ Withheld

  No foreground delay before falling back to the CDN

  All 46,000 devices

  Setting

  DODelayForegroundDownloadFromHttp · not configured → 30 seconds (Microsoft's starting point)

  In the file

  Nothing to download: its setting is withheld, for the reason below

  Withheld

  • DODelayForegroundDownloadFromHttp · Intune ID not shown by Microsoft

    The settings catalog ID for DODelayForegroundDownloadFromHttp follows Microsoft’s naming pattern but is not shown on any Microsoft page. Set it by hand until a tenant export confirms it.

  A foreground delay is added to user-initiated updates. Microsoft warns that a 5-minute value adds 5 minutes to an interactive update; 30 seconds is the suggested starting point. Microsoft gives a different value for devices being provisioned with Windows Autopilot: 0 for the foreground delay (DO-POL-009). Keep 30 seconds for steady state and 0 in a profile assigned to Autopilot devices. Registry value name is pending lab verification; use the Group Policy or Intune path.Microsoft LearnConfigure Delivery Optimization for Windows (opens in a new tab)

• ○ info

  Organisation

  DO-EFF-003

  ○ Withheld

  Background downloads are not being steered towards peers

  All 46,000 devices

  Setting

  DOMinBackgroundQos · not configured → 500 KB/s as a starting point, below your network's average download speed

  In the file

  Nothing to download: its setting is withheld, for the reason below

  Withheld

  • DOMinBackgroundQos · Intune ID not shown by Microsoft

    The settings catalog ID for DOMinBackgroundQos follows Microsoft’s naming pattern but is not shown on any Microsoft page. Set it by hand until a tenant export confirms it.

  DoctorDO does not measure the network's average download speed. The collector's Delivery Optimization performance reading is the bandwidth in use at the moment it runs, so it is not used for this value. Units are contested between Microsoft pages — see docs/15 section 5.3. The CSP denominates this policy in KB/s. Registry value name is pending lab verification; use the Group Policy or Intune path.Microsoft LearnMicrosoft Learn (opens in a new tab)

• ○ info

  Organisation

  DO-POL-009

  ○ Withheld

  Fallback delays can hold up Windows Autopilot provisioning

  10 sites

  Setting

  DODelayCacheServerFallbackForeground · 30 → short, or 0, for devices being provisioned with Autopilot

  In the file

  Nothing to download: its setting is withheld, for the reason below

  Withheld

  • DODelayCacheServerFallbackForeground · Intune ID not shown by Microsoft

    The settings catalog ID for DODelayCacheServerFallbackForeground follows Microsoft’s naming pattern but is not shown on any Microsoft page. Set it by hand until a tenant export confirms it.

  DoctorDO cannot tell from configuration which devices Windows Autopilot provisions. If none of the devices that receive this configuration are, there is nothing to change. Content downloaded during the Enrollment Status Page can use foreground or background priority. Intune Win32 apps download at background priority unless their assignment sets Delivery Optimization priority to foreground, so the background delay governs them by default. Keep the delays in a profile of their own: one with 0 assigned to Autopilot devices, your steady-state values to every other device. Two profiles that set one setting to different values on the same device conflict, and the setting might not apply. Scope it with an assignment filter on enrollmentProfileName, a dynamic device group on (device.devicePhysicalIDs -any (_ -startsWith "[ZTDid]")), or the Autopilot device preparation device group. All three keep matching after provisioning, so those devices keep the provisioning values until you move them. Microsoft's Autopilot guidance names only the HTTP delays. The cache-server delays are listed because, while one runs, a device that cannot reach its cache keeps trying it before it falls back to the HTTP source (DoctorDO's reading of the Connected Cache fallback timing). Before a broad change, test with a representative batch of devices provisioned at the same time and watch the total Enrollment Status Page duration, as Microsoft advises. Registry value name is pending lab verification; use the Group Policy or Intune path.Microsoft LearnConnected Cache: plan for Windows Autopilot provisioning (opens in a new tab)

• Microsoft CDN (HTTP)
• Connected Cache
• LAN · Group · Internet peers
• No bytes
• Policy
• Blocked
• Line weight follows bytes

• Group ID and its source

  DOGroupId · DOGroupIdSource

  In Group mode the Group ID draws the peering boundary. Take it from the AD site, DHCP option 234 or a ConfigMgr boundary group, so one office is one group and sites behind a slow WAN are not.

  Describe this diagram

  Devices in the same AD site share a Group ID and peer; another site is another group.

  Places

  • Group A: Site A
  • Group B: Site B

  Parts

  • Intune (policy source): Source: AD site
  • Microsoft CDN (internet source)
  • Site A
  • Site B

  Connections

  • Intune → Site A: Policy (Group ID = AD site)
  • Microsoft CDN → Site B: HTTP download, active
  • Site B → Site A: Group peering, blocked

• Connected Cache host

  DOCacheHost · DOCacheHostSource · DODelayCacheServerFallback*

  Points devices at a Connected Cache server, statically or from DHCP option 235. The cache fallback delay must be longer than the HTTP delay, or the cache is skipped.

  Describe this diagram

  Devices take content from the cache server on site and fall back to the CDN only after the cache delay.

  Places

  • Site: Connected Cache, Devices

  Parts

  • Microsoft CDN (internet source)
  • Intune (policy source)
  • Connected Cache (connected cache server): Serving
  • Devices

  Connections

  • Microsoft CDN → Connected Cache: HTTP download, active (fills once)
  • Intune → Devices: Policy (DOCacheHost)
  • Connected Cache → Devices: Connected Cache, active
  • Microsoft CDN → Devices: HTTP download, idle (no bytes) (fallback)

• HTTP delay

  DODelayBackgroundDownloadFromHttp · DODelayForegroundDownloadFromHttp

  How long a download waits for peers before it goes to the CDN. Microsoft suggests 60 s background and 30 s foreground; without it, the CDN wins the race.

  Describe this diagram

  Downloads wait for peers first and use the CDN only once the delay has passed.

  Places

  • Site: Peers, Devices

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (wait 60 s / 30 s)
  • Microsoft CDN → Devices: HTTP download, active (after the delay)
  • Peers → Devices: LAN peering, active

• Bandwidth and business hours

  DOMaxBackgroundDownloadBandwidth · DOSetHoursToLimit*

  Caps what downloads take from the WAN, optionally only during business hours. Limits never throttle LAN peers, and a business-hours policy overrides the percentage settings.

  Describe this diagram

  The CDN link is capped in business hours; peering on the LAN is not throttled.

  Places

  • Branch: Peers, Devices

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (cap 08:00–17:00)
  • Microsoft CDN → Devices: HTTP download, active (capped)
  • Peers → Devices: LAN peering, active

• VPN handling

  DOAllowVPNPeerCaching · DOVpnKeywords · DODisallowCacheServerDownloadsOnVPN

  Whether devices on VPN peer, how the VPN is recognised (adapter keywords) and whether they may pull from an on-premises cache through the tunnel.

  Describe this diagram

  Remote devices on VPN take content from the CDN directly; peering and cache downloads over the tunnel are off.

  Places

  • Office: Connected Cache
  • Remote: Remote devices

  Parts

  • Microsoft CDN (internet source)
  • Connected Cache (connected cache server): On premises
  • VPN: Detected
  • Remote devices

  Connections

  • Microsoft CDN → Remote devices: HTTP download, active (direct)
  • Connected Cache → VPN: Connected Cache, blocked (off on VPN)
  • VPN → Remote devices: Group peering, idle (no bytes) (no peering)

Illustrations of each setting, the same in every tenant: they carry no data from this estate.

• Base profile

  ✓ Matches this estate

  P3-large-enterprise

  Large enterprise

  Over 100 devices. Delivery Optimization is designed for this scale.

  △ Sets HTTP fallback delays, which make downloads wait for peers. Before you assign it to devices that Windows Autopilot provisions, read Policy assignment.

  Describe this diagram

  Group mode per site (AD site or DHCP), small files cached and a 60 s wait for peers before the CDN.

  Places

  • Each site: Peers, Devices
  • Group ID = AD site or DHCP: Peers, Devices

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (mode 2 · 60 s delay)
  • Microsoft CDN → Devices: HTTP download, active (after 60 s)
  • Peers → Devices: Group peering, active

  Setting	Recommended	Source	In the file
  DODownloadMode	2	Delivery Optimization reference	△ Only in the “verify IDs” file (2)
  DOGroupIdSource	1 or 3 or 4 or 5	Delivery Optimization reference	○ You choose the value
  DOMinFileSizeToCache	1 MB or lower	Configure Delivery Optimization for Windows	○ You choose the value
  DOMaxCacheAge	604800 seconds or higher	Configure Delivery Optimization for Windows	○ You choose the value
  DODelayBackgroundDownloadFromHttp	more than 0 seconds	Configure Delivery Optimization for Windows	○ You choose the value
  DODelayForegroundDownloadFromHttp	more than 0 seconds	Configure Delivery Optimization for Windows	○ You choose the value

  No setting here can be emitted with a Microsoft-published ID yet.Download with unverified IDs1 settings · import into a test tenant first

• Overlay

  ✓ Matches this estate

  P6-connected-cache

  Microsoft Connected Cache deployed

  One or more MCC nodes serve content locally.

  △ Sets HTTP fallback delays, which make downloads wait for peers. Before you assign it to devices that Windows Autopilot provisions, read Policy assignment.

  Describe this diagram

  Devices take content from the cache server on site and fall back to the CDN only after the cache delay.

  Places

  • Site: Connected Cache, Devices

  Parts

  • Microsoft CDN (internet source)
  • Intune (policy source)
  • Connected Cache (connected cache server): Serving
  • Devices

  Connections

  • Microsoft CDN → Connected Cache: HTTP download, active (fills once)
  • Intune → Devices: Policy (DOCacheHost)
  • Connected Cache → Devices: Connected Cache, active
  • Microsoft CDN → Devices: HTTP download, idle (no bytes) (fallback)

  Setting	Recommended	Source	In the file
  DOCacheHost	any configured value	Configure Delivery Optimization for Windows	○ You choose the value
  DODelayCacheServerFallbackBackground	higher than DODelayBackgroundDownloadFromHttp	Configure Delivery Optimization for Windows	○ You choose the value
  DODelayCacheServerFallbackForeground	higher than DODelayForegroundDownloadFromHttp	Configure Delivery Optimization for Windows	○ You choose the value

  No setting here can be emitted with a Microsoft-published ID yet.

• Base profile

  P1-small-flat-site

  Small flat site

  Under 30 devices on a single subnet behind one NAT.

  Describe this diagram

  One subnet behind one NAT: LAN mode (1) is enough, and peers serve most content.

  Places

  • One subnet · one NAT: Peers, Devices

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (mode 1 (LAN))
  • Microsoft CDN → Devices: HTTP download, active
  • Peers → Devices: LAN peering, active

  Setting	Recommended	Source	In the file
  DODownloadMode	1	Configure Delivery Optimization for Windows	✓ Set to 1
  DOMinFileSizeToCache	50 MB or lower	Configure Delivery Optimization for Windows	○ You choose the value
  DORestrictPeerSelectionBy	0	Configure Delivery Optimization for Windows	△ Only in the “verify IDs” file (0)

  Download Intune JSON1 setting · Microsoft-published IDsDownload with unverified IDs2 settings · import into a test tenant first

• Base profile

  P2-multi-subnet-ad

  Multi-subnet, AD-joined

  30-100 devices across several subnets or sites, domain joined.

  Describe this diagram

  Group mode (2) with the Group ID from the AD site, so subnets in one site peer with each other.

  Places

  • AD site: Subnet A, Subnet B
  • Group ID = AD site: Subnet A, Subnet B

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Subnet A
  • Subnet B

  Connections

  • Intune → Subnet B: Policy (mode 2 · AD site)
  • Microsoft CDN → Subnet B: HTTP download, active
  • Subnet A → Subnet B: Group peering, active

  Setting	Recommended	Source	In the file
  DODownloadMode	2	Delivery Optimization reference	△ Only in the “verify IDs” file (2)
  DOGroupIdSource	1 or 3 or 4 or 5	Configure Delivery Optimization for Windows	○ You choose the value
  DOMinFileSizeToCache	10 MB or lower	Configure Delivery Optimization for Windows	○ You choose the value
  DOMaxCacheAge	604800 seconds or higher	Configure Delivery Optimization for Windows	○ You choose the value

  No setting here can be emitted with a Microsoft-published ID yet.Download with unverified IDs1 settings · import into a test tenant first

• Base profile

  P4-configmgr

  Configuration Manager managed

  ConfigMgr present — reuse boundary groups rather than inventing peer groups.

  Describe this diagram

  Configuration Manager sets the Group ID from its boundary groups, so DO peers inside the boundaries already defined.

  Places

  • Boundary group: Peers, Devices

  Parts

  • ConfigMgr (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • ConfigMgr → Devices: Policy (Group ID = boundary)
  • Microsoft CDN → Devices: HTTP download, active
  • Peers → Devices: Group peering, active

  Setting	Recommended	Source	In the file
  DODownloadMode	2	Delivery Optimization and Microsoft 365 Apps	△ Only in the “verify IDs” file (2)
  DOGroupId	any configured value	Configure Delivery Optimization for Windows	○ You choose the value

  No setting here can be emitted with a Microsoft-published ID yet.Download with unverified IDs1 settings · import into a test tenant first

• Base profile

  P5-hub-and-spoke

  Hub-and-spoke / constrained branch WAN

  Branch sites on limited links, often several subnets behind one NAT.

  Describe this diagram

  Branch devices peer on their own subnet; the WAN link to the CDN is capped during business hours.

  Places

  • Branch subnet: Peers, Devices

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (subnet · hours cap)
  • Microsoft CDN → Devices: HTTP download, active (capped 08–17)
  • Peers → Devices: LAN peering, active

  Setting	Recommended	Source	In the file
  DODownloadMode	2	Configure Delivery Optimization for Windows	△ Only in the “verify IDs” file (2)
  DORestrictPeerSelectionBy	1	Configure Delivery Optimization for Windows	✓ Set to 1
  DOMaxBackgroundDownloadBandwidth	any configured value	Delivery Optimization reference	○ You choose the value
  DOSetHoursToLimitBackgroundDownloadBandwidth	any configured value	Configure Delivery Optimization for Windows	○ You choose the value

  Download Intune JSON1 setting · Microsoft-published IDsDownload with unverified IDs2 settings · import into a test tenant first

• Base profile

  P8-offline

  Offline / air-gapped

  No route to the Delivery Optimization cloud service.

  Describe this diagram

  Simple mode (99): no route to the DO cloud service, so devices download over HTTP and never peer.

  Places

  • Isolated network: Peers, Devices

  Parts

  • Group Policy (policy source)
  • DO cloud (internet source): No route
  • Peers
  • Devices

  Connections

  • Group Policy → Devices: Policy (mode 99 (Simple))
  • DO cloud → Devices: HTTP download, blocked (no route)
  • Peers → Devices: LAN peering, idle (no bytes)

  Setting	Recommended	Source	In the file
  DODownloadMode	99	Delivery Optimization reference	△ Only in the “verify IDs” file (99)

  No setting here can be emitted with a Microsoft-published ID yet.Download with unverified IDs1 settings · import into a test tenant first

• Base profile

  P9-no-p2p

  Peer-to-peer deliberately disabled

  The organisation has chosen not to peer. Selected manually, never auto-detected.

  Describe this diagram

  HTTP-only mode (0): every byte comes from the CDN or a cache; peers are never used.

  Places

  • Site: Peers, Devices

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (mode 0 (HTTP only))
  • Microsoft CDN → Devices: HTTP download, active
  • Peers → Devices: LAN peering, blocked (off)

  Setting	Recommended	Source	In the file
  DODownloadMode	0	Delivery Optimization reference	△ Only in the “verify IDs” file (0)

  No setting here can be emitted with a Microsoft-published ID yet.Download with unverified IDs1 settings · import into a test tenant first

• Overlay

  P7-mobile-heavy

  Laptop / mobile-heavy

  Most devices are laptops or tablets, which roam and run on battery.

  Describe this diagram

  Remote laptops on VPN are recognised by adapter keywords; they upload only above the battery threshold.

  Places

  • Remote: VPN, Laptops

  Parts

  • Intune (policy source)
  • Microsoft CDN (internet source)
  • VPN: Keywords match
  • Laptops: Upload ≥ 40–60 %

  Connections

  • Intune → Laptops: Policy (VPN keywords · battery)
  • Microsoft CDN → Laptops: HTTP download, active
  • VPN → Laptops: Group peering, idle (no bytes) (no peering on VPN)

  Setting	Recommended	Source	In the file
  DOMinBatteryPercentageAllowedToUpload	40-60 percent	Delivery Optimization reference	○ You choose the value
  DOVpnKeywords	any configured value	Delivery Optimization reference	○ You choose the value

  No setting here can be emitted with a Microsoft-published ID yet.

• Overlay

  P-m365-apps

  Microsoft 365 Apps from the Office CDN

  Office updates flow through DO. Not applicable when ConfigMgr or a share manages them.

  Describe this diagram

  With the minimum file size at 1 MB, Office update files are small enough to be served by peers.

  Places

  • Site: Peers, Devices

  Parts

  • Intune (policy source)
  • Office CDN (internet source)
  • Peers
  • Devices

  Connections

  • Intune → Devices: Policy (min file size 1 MB)
  • Office CDN → Devices: HTTP download, active
  • Peers → Devices: LAN peering, active

  Setting	Recommended	Source	In the file
  DOMinFileSizeToCache	1 MB	Delivery Optimization and Microsoft 365 Apps	✓ Set to 1

  Download Intune JSON1 setting · Microsoft-published IDs

The default files contain only settings whose Intune ID and option appear on a Microsoft page. The “verify IDs” files add IDs that follow Microsoft’s naming pattern but are not shown anywhere; import those into a test tenant first. Until DoctorDO has checked them against a real tenant’s export, treat every file as a strong starting point, not a guarantee.