Why traffic for Microsoft edge update is going to random non-microsoft IPs

The shown traffic is consistent with Microsoft Edge using Delivery Optimization or a CDN/Connected Cache node, so validate the initiating process and downloaded content rather than classifying it solely by whether Microsoft owns the destination IP.

Microsoft documents these Edge download origins:

• msedge.f.tlu.dl.delivery.mp.microsoft.com
• msedge.f.dl.delivery.mp.microsoft.com
• Other hosts under *.dl.delivery.mp.microsoft.com

The Edge Update service selects the download location, and Microsoft recommends allowing the wildcard domain rather than fixed IP addresses.^1^

Why a numeric, non-Microsoft IP appears

Delivery Optimization can obtain content from:

• The original HTTP CDN source.
• A Microsoft Connected Cache server.
• An eligible peer.

Consequently, the system serving a file segment does not necessarily have a Microsoft-registered IP. The /filestreamingservice/files/... path is a content-download pattern, while cacheHostOrigin=msedge...dl.delivery.mp.microsoft.com identifies the Microsoft origin associated with the cached content. A closely matching report involving [IP Address] describes this as cache/CDN routing behavior.^2^

The pieceshash request is also significant: Delivery Optimization obtains a Pieces Hash File containing SHA-256 hashes and verifies every downloaded piece against it. Invalid pieces are discarded. If trusted metadata cannot be obtained or verified, the client falls back to HTTP-only delivery.^3^

Connected Cache currently supports Edge content from *.dl.delivery.mp.microsoft.com over HTTP port 80.^4^ HTTP transport alone therefore does not establish that the update is malicious: the client validates metadata hashes, content hashes, and the downloaded content’s signature before installation.^5^

Validate these specific connections

The URL pattern cannot prove that [IP Address] or [IP Address] is legitimate. On an affected endpoint, run this from an elevated Windows PowerShell session while the update is active:

Get-DeliveryOptimizationStatus |
  Select-Object FileId, Status, SourceURL, CacheHost,
    DownloadMode, NumPeers, InternetConnectionCount,
    PredefinedCallerApplication |
  Format-List

Get-DeliveryOptimizationPerfSnap

Check for:

1. Caller — PredefinedCallerApplication should identify the expected Microsoft update workload rather than an unrelated process.
2. Origin — SourceURL should correspond to the documented Edge delivery domain.
3. Cache source — CacheHost can identify the cache-server IP being used.
4. Download mode and peers — these show whether Delivery Optimization peering is involved.

These fields are documented by Microsoft’s Delivery Optimization monitoring guidance.^6^

Also verify that the final downloaded executable or installer has a valid Microsoft digital signature. Treat the event as suspicious if an unrelated process initiated it, the origin does not match the documented endpoint family, or signature validation fails. In that case, block the specific IP temporarily, preserve the proxy/EDR logs and downloaded sample, and run a Microsoft Defender scan.

If peer traffic is not permitted

Configure Download Mode = HTTP Only (0) under:

Computer Configuration → Administrative Templates → Windows Components → Delivery Optimization → Download Mode

Mode 0 disables peer-to-peer caching while retaining Delivery Optimization’s metadata and hash checks. It can still use the original HTTP source or a configured Microsoft Connected Cache server.^7^

Do not use Bypass (100) on Windows 11; it is deprecated and can cause downloads to fail. Simple (99) is intended for devices without Internet access, not as the normal way to disable peering.^8^

References

1. Allowlist for Microsoft Edge endpoints | Microsoft Learn
2. Observe multiple outbound traffic with Microsoft domain
3. How Delivery Optimization works | Microsoft Learn
4. Microsoft Connected Cache content and services endpoints
5. Microsoft Connected Cache for Enterprise and Education Secure Content Delivery
6. Monitor Delivery Optimization
7. Delivery Optimization reference
8. Frequently Asked Questions about Delivery Optimization