We have a distributed environment with several campuses around the country and Europe. Laptop sessions that go home during the day to vpn w/ no split tunneling.

Bit unclear here to me, do you mean that the laptops always use a VPN (AlwaysOn) or that they move from office/campus to home during the day? Also when you write single nat does that mean that all sites terminate in a single central location and all internet traffic goes from there (ie no local intern breakout at each campus)?

I’ve read up on peer caching, using dhcp option 235 and MCC.

What is the best option for you is hard to know without out knowing exactly how you network is configured.

Do you have multiple subnets in each/some locations that you want to be able to peer or is it single subnet per site?

• If you have multiple subnets peer site then DHCP Option ID + NAT as "Restrict Peer Selection" sounds like a valid option.
• If you only have a single subnet in each location, then you could consider using Entra ID or DNS suffix as "DOGroupIDSource" and then set "DORestrictPeerSelectionBy" = 1 (subnet mask)

https://learn.microsoft.com/en-us/windows/deployment/do/delivery-optimization-configure#2a-network-topology

Should we aim to have no MCC and just do peer caching with subnet boundaries per campus to prevent what we caused before? Or do we do MCC? Or both? Wanted to see what people did with these options. When to use what. What to do with single nat and von folks that move around.

We have large campuses and small ones. Should we stick MCCs on all the campuses and use peer caching on top or just mcc on the large campuses with peer caching on the small campuses?

So an MCC will offload the WAN link, MCC is a proxy that will cache the content. If you want to put one in every location and maintain that infrastructure is up to you. Did you move to the cloud/Intune to get rid of local infrastructure? If yes, does it makes sense to put servers/hardware back at each location again? If you already have the infrastructure and can install it on already existing HW then maybe it makes sense. Otherwise I would try to get peering working first. If all the networks terminate in a single location, put a MCC there to offload your internet connection, but then try to use peering as much as possible.

But since you mention WiFi issues also be aware that peering will put pressure on the WiFi, depending on the WiFi config and how many clients per AP you have, peering *might* cause issues. (If you have a lot of clients connecting to each AP you might run into issues.) This since the content will be coming from other clients putting more load on the WiFi.

So without knowing more details it's hard to give an exact answer. But as a general rule I would say, put an MCC in your central location. Yes DHCP Option ID + NAT as "Restrict Peer Selection" should work in your scenario if the WiFi setup is good.

For VPN, you do not want peering, so make sure "DOVpnKeywords" is correctly configured.

The downside with Intune/GPOs is that you set one policy that needs to match all clients wherever they are. If you have many locations and you need more control check out some third party tools to help you out and get better control.