I was only after the MS Delivery Optimization service that they added in Windows 10 for doing Windows Updates and MS Store downloads. This is what I found:
/ip firewall layer7-protocol
add name=MS-DoSvc regexp=User-Agent:.Microsoft-Delivery-Optimization
then in /ip firewall mangle make a rule that uses layer7-protocol=MS-DoSvc to identify the connections and mark them per your favorite method.