Can anybody help what is best way to mark and limit MS services like updates and so on..?

I was only after the MS Delivery Optimization service that they added in Windows 10 for doing Windows Updates and MS Store downloads. This is what I found:

/ip firewall layer7-protocol
add name=MS-DoSvc regexp=User-Agent:.Microsoft-Delivery-Optimization

then in /ip firewall mangle make a rule that uses layer7-protocol=MS-DoSvc to identify the connections and mark them per your favorite method.

Cool find Ravenwing

Please also see http://forum.mikrotik.com/viewtopic.php?f=2&t=51802