What is PlayReady DRM and how it works

What is PlayReady DRM?

Microsoft PlayReady DRM is a set of technologies used to securely distribute audio and video content over the network and prevent unauthorized use. It defines and enforces the user's rights to digital media content.

Content service providers can control the expiration date of playback, the resolution that can be played on the screen, the type of output the content is rendered to, and more. PlayReady is integrated into media apps on TVs, set-top boxes, PCs, game consoles, and other devices to enforce the access rules defined by content owners.

A short history

PlayReady was announced in 2007 as the successor to Windows Media DRM (WMDRM) and shipped its first version in 2008. It has been updated steadily since then, and the current release is PlayReady 4.8.1 (April 2026). (Ref. 1)

Features by version

• 1.x (2008-2010): embedded license, Smooth Streaming common encryption
• 2.x (2011-2014): key rotation for live TV, MPEG-DASH
• 3.x (2015-2017): SL3000 security level, multi-key, Secure Stop, Secure Time
• 4.0 (2017): AES-CBCS ('cbcs') encryption mode, Secure Delete
• 4.2 (2019): SecureStop2, cbcs on Windows for both hardware and software DRM
• 4.3-4.6 (2019-2022): Server SDK on .NET Core (Linux/macOS servers), client feature reporting to the server, multi-key licenses
• 4.7-4.8 (2025-2026): dual-signed certificates, a new revocation list required by 4.8+ servers, .NET Framework Server SDK dropped (Ref. 2)

Components and how they work

The PlayReady ecosystem has two main components, the client and the server, which communicate using protocols specified by Microsoft. (Ref. 3)

Content is encrypted by a packager that supports PlayReady, then sent to clients that decrypt and play it using the information stored in the DRM license.

• PlayReady client: a device or app that can play protected content once it's licensed for that content, such as a browser on a PC or an app on a smart TV or game console. Device makers build it with the PlayReady Porting Kit. The client enforces the rights and restrictions in the license while playing the content.
• PlayReady server: issues licenses to clients. Content service providers or DRM vendors build it with the PlayReady Server SDK, which now ships for .NET only, to support their own business logic.

Microsoft retired Azure Media Services, which included a PlayReady license delivery service, on June 30, 2024. PlayReady licenses are now issued by your own server built on the Server SDK or through a DRM vendor. (Ref. 4)

Security levels

Every PlayReady client has a security level, and each license sets the minimum level a client needs to play the content. Services use this to deliver HD or UHD only to clients with a high enough level. (Ref. 5)

• SL150: for development and testing only, not for commercial content
• SL2000: hardened software or hardware protection, often called software DRM
• SL3000: protection backed by a Trusted Execution Environment (TEE) on the device, often called hardware DRM

SL3000 is what studios expect for premium content such as UHD and early-window movies. On Windows, SL3000 needs supported hardware (GPU and drivers), and Windows PCs with that hardware can play content like Netflix UHD in Edge. (Ref. 6)

Use cases

Rental

The license for rental content specifies an expiration date and time. After that point the content and its license may still be on the device, but the PlayReady client uses the device's secure time to expire the license.

Subscription

The PlayReady Server doesn't include business logic, but it connects to your business backend, so subscription licenses can get an expiration time just like rentals. Clients request a license for each piece of content they play, and a service can return several licenses in one response.

Purchase and download

Users expect purchased content to play indefinitely on their device, so services often issue licenses with no expiration time. If the user changes devices, or the device's PlayReady identity changes, the service has to reissue licenses for that content.

Supported platforms and content formats

Browsers

In the browser, PlayReady is used through the EME key systems below. (Ref. 7)

• com.microsoft.playready.recommendation: SL2000 (software DRM)
• com.microsoft.playready.recommendation.3000: SL3000 (hardware DRM, on supported hardware)
• com.microsoft.playready: the legacy key system, now deprecated

Edge on Windows supports both. Chrome on Windows 11 can also use PlayReady SL3000 once hardware secure decryption is enabled; see the DoveRunner guide. Firefox doesn't support PlayReady.

Devices

• Windows: Edge, and Windows apps
• Smart TVs: LG webOS supports PlayReady. Samsung Tizen still supports it, but Samsung now calls it deprecated and no longer recommended for new models (Ref. 8).
• Other OTT devices: Xbox and many set-top boxes

Android and Chromecast don't support PlayReady natively; they use Widevine. See DoveRunner's supported environments for current per-platform details.

Content formats

• Streaming formats: MPEG-DASH, HLS, CMAF (Smooth Streaming is also supported)
• Encryption modes: cenc, and cbcs on PlayReady 4.0+ clients
• Video codecs: AVC (H.264), HEVC (H.265)
• Audio codecs: AAC, AC3

For multi-DRM, pick the format with the widest client support that also works with Widevine content.

DoveRunner Multi-DRM is a cloud-based SaaS that manages PlayReady, Widevine, and FairPlay licenses through one integration.