Skip to content
DoctorDO
Demo

Delivery Optimization diagnostics for Microsoft Intune. Know where your updates and apps came from, and why.

DoctorDO reads what Windows already records about Delivery Optimization (DO) on each device you manage with Microsoft Intune. From the whole estate down to one site, subnet, or device, it shows where your updates and Win32 apps came from (peers, Microsoft Connected Cache, or Microsoft’s CDN), what’s stopping devices sharing content, and the Intune policy that fixes it.

Open the demo portalSee how it worksThree ways to run itThe demo is ContosoAI, a fictitious company with 46,000 devices. Its figures are modelled, not computed from collector reports. There’s no sign-in and nothing to install.

Measure

Where your updates and apps came from, on one page.

Delivery efficiency, the bytes that peers and your own Connected Cache kept on your network, and a map of every site, all for the last 30 days.

  • Bytes by source for the estate, each site, and each device
  • The findings to fix first, the most serious at the top
  • Each change to a setting, whether by Intune, Group Policy, or locally, marked on the trend on the day it was first seen
See the Overview in the demo

News

The PowerShell module is out. The full solution is next.

Available now

DoctorDO on the PowerShell Gallery

The PowerShell module is on the PowerShell Gallery: one command writes a device report. It is one HTML file with Delivery Optimization health, network health, download sources, and configuration, made with no Azure, and nothing leaves the device.

From an elevated PowerShell prompt
Install-Module -Name DoctorDO -Scope CurrentUser
New-DoctorDODeviceReport
View it on the PowerShell GalleryThe one-device report
Coming soon

A private preview of the full solution

A private preview of the full solution is coming soon. The portal, ingest, and database run in your own Azure subscription, and an Intune remediation rolls the collector out so every managed device reports every day.

Until then, the live demo runs every page of the portal on ContosoAI, a fictitious company.

What the full solution needs
Built forMicrosoft IntuneWindows Update for Business reportsMicrosoft Connected CacheMicrosoft Entra ID

The problem

Windows keeps the Delivery Optimization evidence. Reading it, device by device, is the hard part.

For the Intune administrator who has been told the WAN is full and has to show which devices filled it, and why.

Reduce bandwidth

Find the WAN traffic that peers or Connected Cache should have served.

Delivery Optimization is meant to keep updates, apps, and Microsoft 365 content on your own network.1 When it doesn’t, no error appears. The bytes come from the internet instead, and DoctorDO shows how many, device by device and site by site.

  • Every byte by its five sources: the HTTP source (usually Microsoft’s CDN), Connected Cache, and LAN, group, and internet peers
  • A company goal, with the sites short of it ranked by what they would keep local
  • What stops devices sharing: Wi-Fi client isolation, blocked peer ports, proxies that inspect TLS, and uploads turned off
  • Where a Connected Cache server would pay off, with an estimate of what it saves
Plan Connected Cache placement in the demoLearn: Microsoft Connected Cache

Faster app and Autopilot deployments

Stop Win32 apps and Autopilot devices waiting on the internet.

Win32 apps, Microsoft 365 Apps, Teams, and Windows updates all arrive through Delivery Optimization, and a setting that makes a download wait for peers or a cache can hold up Windows Autopilot provisioning. Microsoft calls devices being provisioned transient peers;4 in DoctorDO’s reading, they’re the devices most likely to have nothing nearby to wait for.

  • Flags the HTTP fallback delays that can hold up Autopilot provisioning, checked against the Enrollment Status Page’s 60-minute default time-out3 and Microsoft’s Autopilot guidance4
  • A provisioning profile beside the everyday one, and how to target each
  • Where Intune Win32 apps, Microsoft 365 Apps, Teams, and Store content came from, device by device
  • Download errors from Delivery Optimization’s log, decoded and tied to the app or update that failed
See each device’s download sources in the demoLearn: Policy assignment

Drill down to one device

From the whole estate down to one device.

Sites, subnets, peer groups, caches, and the way out to the internet, drawn from what devices report rather than from a diagram someone drew years ago. Each level opens the one below it, so a site that falls short leads you to the subnet, the peer group, and the device behind it.

  1. Estate
  2. Site
  3. Peer group
  4. Subnet
  5. Device
  • A site: how its subnets share, what stops them, such as Wi-Fi client isolation or a blocked port, and which devices carry the sharing
  • Peer groups by Group ID: the subnets each one spans, and a group that leans on a single device
  • A subnet: whether its devices can reach each other, and every device in it
  • One device: where each file came from, its download mode, every setting and who set it, its failed checks, and whether it gives back to peers
Drill into the estate map in the demoLearn: Group IDs

Built from the field

Three problems that stop peering without an error.

Each case runs from the problem to the rule that finds it, and to the MSEndpointMgr post or Microsoft page it rests on.

  1. 01DoctorDO’s reading

    Wi-Fi client isolation

    Devices are offered peers and their own firewall lets Delivery Optimization in, yet every connection between them fails. Nothing on the device reports an error.

    The rule DO-NET-002 and 1 source

    Compares the peer connections attempted with those established, on devices whose TCP 7680 rule passes, and names the subnet or site where they fail.

    Microsoft documents the port and the failed connection, not client isolation.

    Sources

  2. 02

    TLS inspection

    A proxy that inspects TLS breaks the connection to the Delivery Optimization service, which pins its certificate. Devices get no peers, every byte comes from the CDN, and no error says why.

    The rule DO-NET-006 and 2 sources

    Checks who issued the certificate each device receives on the service’s endpoints, judging the issuing chain rather than the certificate’s own name, which an inspecting proxy can copy. A chain that is not Microsoft’s means inspection, and the finding says which endpoints to exempt.

    Sources

  3. 03

    Content that can’t be peered

    Efficiency falls away and the network team is blamed, but much of the content could never have been peered. Size is one reason: unless you change it, a file under 50 MB is not peered at all.

    The rules DO-BASE-001, DO-BASE-002 and 2 sources

    Compares DOMinFileSizeToCache, whether set or left at its 50 MB default, with Microsoft’s table for an estate of your size: 10 MB above 30 devices, 1 MB above 100.

    Sources

Every statement of Microsoft’s guidance links to the page it rests on. Where DoctorDO concludes something Microsoft does not document, it is labelled DoctorDO’s reading. The Learn page cites 24 Microsoft Learn pages.

Where the knowledge comes from

How it works

From deployment to your first findings.

There’s no DoctorDO licence fee and no appliance to put on the network, and you keep deploying policy the way you do today.

  1. Deploy to Azure

    Run one script against your Azure subscription. It deploys the portal, the ingest functions, and the database, and sets up sign-in for your tenant.

  2. Roll out the collector

    Add the two remediation scripts to Intune. The remediation installs and verifies the collector module on each device, then runs it on a schedule. Devices start reporting.

  3. Review the results

    Sign in to see every device and site: where the bytes came from, what fails, and how each site compares with your goal.

  4. Act, then measure

    Import the Intune policy a finding exports, assign it, and watch the trend show whether it helped.

Three ways to run DoctorDO, from one device to the whole estate.

DoctorDO is in preview. The PowerShell module is on the PowerShell Gallery: one command writes a device report. A private preview of the full solution is coming soon. Until then, explore the live demo.

  1. The full solution, in your Azure

    The portal, ingest, and database in your own subscription, with the collector rolled out by an Intune remediation. Every device, every day.

    The full solution

  2. One device, with PowerShell

    One command on one device writes its report as a single HTML file, with no Azure and nothing sent anywhere.

    The one-device report

  3. Through Intune, with no Azure

    A remediation writes the report into the Intune logs folder, and Collect diagnostics in the Intune admin center brings it back.

    Intune and Collect diagnostics
What it needsHow the parts fit togetherRead the collector guide

Your data

It runs in your Azure subscription and changes no setting on its own.

Nothing is a black box: the collector is PowerShell, with one C# helper in source form, and every field it sends is listed.

What it reads, sends, and changesHow to review it
  • In your own Azure subscription
  • Only your managed devices report
  • Sign in with Microsoft Entra ID
  • No setting changed for you
  • No setting ID guessed
  • Rules backed by Microsoft sources

Costs

Less than a cent per device a month, billed by Azure.

DoctorDO is free to use; you pay only for the Azure resources it runs on. At the demo’s size, 46,000 devices with a report from each every day, that is about $0.08 per device a year ($316 a month for the whole estate). The costs page works it out from Azure list prices, resource by resource, for the demo’s size and for yours.

See the costsWork out your own estate

Questions

Common questions.

Does DoctorDO change anything on my devices?
It changes no Delivery Optimization, firewall, proxy, or service setting. It does install the collector module, keep a small state folder and two registry values, and write a log, and it makes outbound connection checks. Nothing else changes until you import a policy and assign it. Your data has the details.
Where does my data go?
Into your own Azure subscription, with no shared service in between. Your data says how each report is checked and who can sign in.
Can our security team review the code?
It is built for that. The collector is PowerShell, with one C# helper whose source is in the module; the infrastructure is Bicep, applied by PowerShell and Node scripts in the same repository; and the payload has a published schema. The repository is private during the preview and will be public. DoctorDO’s licence, the PolyForm Shield License 1.0.0, is source-available, not open source, and it allows a security review. Open to review says what to read, how to check it, and the licences.
What does it cost?
DoctorDO is free to use; you pay only for the Azure resources it runs on. The costs page works out what those resources cost for an estate your size. The collector runs from an Intune remediation, and Remediations need the devices’ users to have a Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows VDA licence (included in Microsoft 365 F3, E3, E5, A3, and A5).
What do I need to deploy it?
Azure and Microsoft Entra roles to deploy it, Windows devices that are Entra joined or hybrid joined and enrolled in Intune, and a licence that includes Intune Remediations. What it needs lists each one.
How do I get it?
DoctorDO is in preview. The PowerShell module is on the PowerShell Gallery: one command writes a device report. A private preview of the full solution is coming soon. Until then, explore the live demo.
Do I need Microsoft Connected Cache?
No. DoctorDO works with or without one. If you’re considering Connected Cache, it shows the sites where a cache server would pay off, and what it would save.
Does DoctorDO show where Win32 apps came from?
Yes. A device’s page marks which of its downloads were Intune Win32 apps, and where each one’s bytes came from: peers, Microsoft Connected Cache, or the CDN. The guide to Intune Win32 apps and Delivery Optimization says how.
How does DoctorDO compare with Microsoft’s Delivery Optimization report?
Microsoft’s report, in Windows Update for Business reports, shows Delivery Optimization over 28 days by content type, Group ID, and location.5 It doesn’t say why content didn’t come from a peer. DoctorDO does, for each device and site, and can put Microsoft’s figures beside its own. The guide to Delivery Optimization reports compares the two.
Can I try it on one device first?
Yes. The module is on the PowerShell Gallery: run Install-Module -Name DoctorDO -Scope CurrentUser and then New-DoctorDODeviceReport from an elevated prompt, and you get that device’s report as a single HTML file, with nothing deployed and nothing sent anywhere. A private preview of the full solution is coming soon. The one-device report has the options.
Does it use AI?
Not for the findings. They come from rules, and each one shows its evidence and its Microsoft source. If you connect Azure OpenAI in your own subscription, the Reporting page adds a briefing written from the same evidence.
Is DoctorDO a Microsoft product?
No. It’s an independent community project. The independence statement at the foot of this page says what that means.

New to Delivery Optimization?

The Learn page covers the parts that matter, each with Microsoft’s documentation. Five guides in the demo go into depth, and four more take common questions further.

In depth, in the demo

Microsoft documentation cited on this page (5)
  1. 1What is Delivery Optimization? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization
  2. 2Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
  3. 3Set up the Enrollment Status Page (opens in a new tab)learn.microsoft.com/intune/device-enrollment/windows/setup-status-page
  4. 4Microsoft Connected Cache for Enterprise and Education overview: plan for Windows Autopilot provisioning (opens in a new tab)learn.microsoft.com/windows/deployment/do/mcc-ent-edu-overview#plan-for-windows-autopilot-provisioning
  5. 5Delivery Optimization data in Windows Update for Business reports (opens in a new tab)learn.microsoft.com/windows/deployment/update/wufb-reports-do

See the whole portal before you deploy anything.

This portal runs every page on ContosoAI, a fictitious company with 46,000 devices, at 41 sites in 16 countries and working remotely. Its figures are modelled, not computed from collector reports. Every company, site, and figure in ContosoAI is invented; the problems are ones met in real estates.

Open the demo portalGet started