What Is PlayReady? Microsoft's DRM Explained

Ask most viewers what is PlayReady and you will get a blank look. Yet if you have streamed a film in Microsoft Edge, on an Xbox or on many smart TVs, PlayReady was doing the work. It is Microsoft’s digital rights management system, and it quietly sits behind a large share of premium video on Windows and in the living room.

This guide explains what PlayReady is, how its licence flow works, what the security levels SL150, SL2000 and SL3000 mean, and when a streaming business actually needs it.

Where PlayReady came from

Microsoft introduced PlayReady in 2007 as the successor to Windows Media DRM. It started life around Silverlight and Smooth Streaming, Microsoft’s early adaptive streaming format. Silverlight is long gone, but PlayReady kept evolving. Later versions added support for DASH and HLS with CMAF, hardware-backed security on PCs and, from version 4.0, the cbcs encryption scheme that lets one set of files serve PlayReady, Widevine and FairPlay together.

Where it runs

• Microsoft Edge on Windows, including hardware-protected playback on supported graphics chips.
• Windows apps built on the platform’s media framework.
• Xbox consoles.
• Smart TVs and set-top boxes from many manufacturers, often alongside Widevine.
• Operator platforms in pay TV, where PlayReady has deep roots.

It is not available in Chrome or Firefox, and Apple devices do not support it. A typical service therefore offers PlayReady to Edge, Xbox and TVs, Widevine to Chrome, Android and Firefox, and FairPlay to Apple devices. That combination is called multi-DRM.

How a PlayReady licence request works

The flow will look familiar if you have read about other DRM systems, with a few PlayReady-specific names.

1. Packaging. The video is encrypted with Common Encryption. A PlayReady Object (PRO) is placed in the pssh box of the media and in the DASH manifest’s ContentProtection element. Inside the PRO sits the WRM header, an XML document naming the key ID and the licence server URL.
2. Detection. In the browser, the player sees the PlayReady system ID and asks for the com.microsoft.playready.recommendation key system through Encrypted Media Extensions.
3. Challenge. The PlayReady client on the device builds a licence challenge, an XML SOAP message signed with the device’s certificate.
4. Licence. The player sends the challenge to the licence server, with your own authentication. The server checks the device and the viewer, then returns a licence containing the content key and its policy.
5. Playback. The client binds the licence to the device, decrypts the video and enforces the rules, including output protection.

Licences can be non-persistent, lasting only for the playback session, or persistent, stored on the device for offline viewing and rentals.

Security levels: SL150, SL2000, SL3000

PlayReady clients are certified at a security level. The licence server can refuse to issue keys for content that needs a higher level than the device offers.

SL3000 is roughly equivalent to Widevine L1. It is also the reason Edge on a modern Windows PC can often receive higher resolutions than Chrome on the same machine, which runs Widevine in software only. We cover that effect in why Netflix plays in low quality on PC.

In the browser, a player can request a level with the robustness value in its EME configuration. 3000 asks for hardware security, and 2000 for software. Our DRM support checker runs exactly these requests, so you can see what a given PC and browser will accept.

Policies you can set

PlayReady licences are flexible. Common rules include:

• Expiry. An absolute end date, or a window after first play, as used for rentals.
• Output protection. Minimum HDCP versions for analog and digital outputs, per quality level.
• Security level. For example, SL3000 required for 4K tracks.
• Persistence. Whether the licence may be stored for offline use.
• Key rotation for live channels, so each key only unlocks a short window.
• Domain binding, which lets a set of devices share licences under one account, a feature used by some operator services.

When do you need PlayReady?

Not every service does. It depends on your audience and your contracts.

You probably need it if:

• Your viewers watch a lot in Edge on Windows and you want to offer HD or 4K there.
• You are building apps for Xbox.
• You deliver to smart TVs or set-top boxes where PlayReady is the default, or where an operator contract specifies it.
• Your content licences require hardware-level protection on Windows for top resolutions.

You might not need it if:

• Your audience is mostly mobile and Chrome, where Widevine and FairPlay cover you.
• Your content is lower value, such as internal training, where software Widevine in Edge is enough. Edge supports Widevine too.

Many multi-DRM vendors include PlayReady at no extra complexity, so the practical question is often just whether to switch it on.

Testing a PlayReady setup

A sensible test plan covers:

1. Edge on Windows with a recent GPU. Confirm SL3000 is offered and that 4K or your top rendition plays.
2. Edge on an older or virtual machine. Confirm the player falls back to SL2000 or Widevine gracefully rather than failing.
3. An Xbox or smart TV, if they are target platforms.
4. An external monitor without HDCP 2.2, to check your player handles output restrictions by lowering quality.
5. Licence errors. Break your token on purpose and make sure the player shows a useful message.

Play the manifest in our DASH player for unprotected test copies, to confirm that packaging and codecs are right before you add the licence layer.

Common PlayReady problems

Edge plays in HD but not 4K. The GPU, driver or display may not support hardware DRM and HEVC decoding, or HDCP 2.2 is missing. Update drivers and connect the monitor directly.

Playback fails in a virtual machine or remote desktop. Hardware DRM is not available in these environments. This is expected.

Licence server returns an error about the client. The device may be revoked or running an outdated PlayReady version. Updating Windows or the TV firmware usually fixes it.

Works in DASH, fails in HLS. Check that your HLS playlists carry PlayReady signalling correctly and that your player supports PlayReady with HLS. Many teams simply use DASH for PlayReady.

PlayReady on smart TVs and set-top boxes

The living room is where PlayReady is most entrenched. Many TV makers ship both PlayReady and Widevine in their firmware, and pay TV operators often mandate PlayReady in their device specifications. If you are launching a TV app on a platform such as Tizen, webOS or an operator’s set-top box, check the platform documentation early. Some platforms prefer PlayReady for their best-quality streams, and a few older models do not support the cbcs scheme at all, which may force you to keep a cenc copy of your content for them.

TV apps also tend to stay installed for years without updates. That makes licence server compatibility more important than on phones, where apps update constantly. When you choose a DRM vendor, ask how long they support older PlayReady client versions.

Building your own licence server vs using a vendor

Microsoft licenses PlayReady server software to companies that want to run their own licence infrastructure. Large broadcasters and operators sometimes do, because they want full control over policies, integration with their subscriber systems and no per-licence fees.

For almost everyone else, a multi-DRM vendor is simpler. You get PlayReady, Widevine and FairPlay behind one API, with key management, token validation and monitoring already built. The trade-off is ongoing fees. As a rough rule, a dedicated team and in-house licence servers only start to make sense at very large scale, or where contracts demand them.

How PlayReady handles live channels

Live TV adds a twist: content keeps flowing for hours or days, so a single key would protect a huge amount of video. PlayReady supports key rotation, where the key changes at regular intervals, and embedded licences, where licence data travels inside the stream. Together they let a player keep watching a channel without a new licence request every few minutes, while a leaked key only exposes a short slice of the broadcast. If you run live sports or linear channels, ask your vendor how they implement rotation for PlayReady specifically, because behaviour differs between devices.

Summary of the practical questions

Before switching PlayReady on, answer three questions. Do enough of your viewers use Edge, Xbox or TVs to matter? Do your content licences require hardware protection on Windows? And does your player and vendor support PlayReady on every platform you target? If the answer to any of them is yes, turn it on, test it on real hardware with the DRM support checker, and keep an eye on licence errors after launch.

Summary

PlayReady is Microsoft’s DRM, used in Edge, Windows apps, Xbox and many TVs. Content is encrypted with Common Encryption and described by a PlayReady Object, the device sends a signed challenge, and the licence server returns a key with rules for expiry, output protection and security level. SL3000 provides hardware-backed protection for top-quality video, which is why Edge on Windows often outperforms Chrome for premium streams. If your audience watches on Windows, Xbox or TVs, PlayReady belongs in your multi-DRM setup.