Delivery Optimization and Connected Cache with Intune: settings, peering and verification

Intune-managed Windows devices download Win32 apps and Windows updates through Delivery Optimization whether you configure it or not, and Microsoft 365 Apps can use it too. Configured well, devices share content with each other and with a local Microsoft Connected Cache node instead of each pulling the same large package over a slow link. In this post I'll set up the Intune policy, add Connected Cache, and show how to prove where each byte came from.

How it works#

Delivery Optimization (DO) asks Microsoft's DO cloud service which peers have the file, then downloads pieces of the file from three kinds of source:

• HTTP: the Microsoft content delivery network (CDN), always available as a fallback.
• Peers: other Windows devices with the file in their DO cache, on the same LAN or in the same group, depending on the download mode.
• A cache server: a Microsoft Connected Cache node that you host. Devices request content from it, it fills itself from the CDN, and devices fall back to the CDN if it's unavailable.

Win32 apps from Intune use this pipeline, and so do Windows feature and quality updates, Microsoft 365 Apps, Store apps and Defender definition updates.

Prerequisites#

• Peers must reach each other on TCP 7680, the port DO listens on; check host firewalls and any client isolation on Wi-Fi.
• Devices need the default peering thresholds or lower ones: at least 4 GB of RAM and a 32 GB disk unless you change DOMinRAMAllowedToPeer and DOMinDiskSizeAllowedToPeer.
• For Connected Cache: an Azure subscription to create the resource, and a host. Microsoft positions a Windows 11 device for branch offices of roughly 10 to 50 devices, and Windows Server 2022 or later or Ubuntu 24.04 for larger sites. On Windows the cache runs in Windows Subsystem for Linux under a group managed service account, a local user or a domain user.

Step-by-step#

1. Create the Delivery Optimization policy#

The original Delivery Optimization template was replaced on 24 April 2025 by one in the settings catalog format. Create a settings catalog profile (Devices › Configuration › Create, platform Windows) and add settings from the Delivery Optimization category:

Assign it to device groups, and avoid setting the same DO values through Group Policy as well. Security baselines need a check too: Microsoft notes that their firewall defaults might not merge local rules with MDM rules, and advises validating them before you assign a baseline to devices that use Delivery Optimization.

2. Set the Win32 app priority#

In each Win32 app assignment, Delivery optimization priority decides whether the content downloads in the background (the default) or the foreground. Use foreground for required apps users wait on, such as those in the Enrollment Status Page, and keep background for large optional apps.

3. Deploy Microsoft Connected Cache for Enterprise and Education#

1. In the Azure portal (or Azure CLI), create the Connected Cache resource and a cache node for each site.
2. Download the node's deployment package (a Windows application, or bash scripts for Linux) and run it on the host. The cache container is deployed through Azure IoT Edge and starts reporting status once it's running.
3. Point clients at the node with the DOCacheHost setting in your Intune DO policy, using the node's FQDN or IP address. A custom DHCP option or a registry value can deliver the same setting.
4. If the cache must win over the CDN, set the cache server fallback delays for foreground and background downloads so devices don't fall back immediately.

Verify#

First confirm the policy landed. Get-DOConfig -Verbose lists every DO setting with its provider, so you can tell MDM values from defaults:

Get-DOConfig -Verbose
Get-DODownloadMode
Get-DeliveryOptimizationStatus |
    Format-Table FileId, PredefinedCallerApplication, Priority, Status, FileSize,
                 BytesFromPeers, BytesFromCacheServer, BytesFromHttp, CacheHost -AutoSize

Good looks like this: DownloadMode shows your value with DownloadModeProvider set to the MDM provider, and recent large files show bytes from peers or the cache server. Note that BytesFromHttp counts all HTTP sources, including the cache server, so compare it with BytesFromCacheServer rather than reading it as CDN traffic. CacheHost shows the cache server's IP address.

Get-DeliveryOptimizationStatus -PeerInfo | Format-Table IP, PeerType, ConnectionEstablished, BytesReceived
Get-DeliveryOptimizationPerfSnapThisMonth

-PeerInfo lists candidate peers per file and whether a connection was made; potential peers that never connect often point to a blocked port 7680. The performance snapshot for the month shows totals and connection counts to Connected Cache servers, CDN servers and peers. For the estate view, the Delivery Optimization report in Windows Update for Business reports covers the past 28 days, and the Azure portal shows usage per cache node.

Tips & gotchas#

• Local changes don't stick. Set-DODownloadMode and the other Set-DO* cmdlets are handy for tests, but MDM or Group Policy overrides them at the next refresh.
• Small files don't peer. Files below the minimum size for caching always come over HTTP, so test with a large app or update.
• Group mode includes the LAN. Bytes from peers on the same LAN are counted as LAN peers even in group mode.
• Bandwidth caps. By default, DO uses up to 90% of available bandwidth for foreground downloads and 45% for background downloads.
• Read the logs when it stalls. Get-DeliveryOptimizationLog needs an elevated session. App-side failures such as 0x87D30065 are covered in Win32 app download and install errors.
• Co-managed estates. Connected Cache on a Configuration Manager distribution point is compared with peer cache and BranchCache in peer cache vs BranchCache vs Delivery Optimization.

References#

• Delivery Optimization reference
• Microsoft Connected Cache for Enterprise and Education overview
• Monitor Delivery Optimization