How to configure Widevine packaging with Azure Media Services

This blog is a follow up of our IBC announcement a few days ago for adding Widevine capability on the platform. Now you could either develop using .NET SDK 3.5.1 or Azure Media Services Explorer Tool to add Widevine header in a common encrypted DASH stream easily.

1. Update .NET SDK 3.5.1 or higher version into your project through Nuget.

2. I have uploaded a sample code project in Github for configure both PlayReady and Widevine packaging on a particular asset through Dynamic Encryption feature. In order to do this, you will need at least 1 Reserved Streaming unit configured on your media services account.

3. When you open this project, the first thing is to replace Account Name and Account Key in app.config file.

4. Here is the code I added for adding Widevine header on the stream:

There are two lines of changes you need to pay attention:

a. Line 9: Adding WidevineLicenseAcqusitionURL in AssetDeliveryPolicyConfigurationKey with a custom URL. In the code above, I am putting a dummy Widevine license URL(http://testurl) since Azure Media Services doesn’t have Widevine License delivery services at the moment. Versus for PlayReady, you can see we could retrieve a License Delivery URL from AMS. We give you partner options such as EZDRM, Axinom or castLabs to choose from, once you set up License delivery services from them, you could bring the license URL in and replace “http:testurl”. You could also choose to put nothing as License URL and override it with player API later.

b. Line 16: On AssetDeliveryPolicy creation, Widevine header will only appear when a DASH dynamic encryption is configured. If your AssetDeliveryProtocol is HLS or Smooth Streaming, Widevine header will not be added.

5. You will be getting a streaming URL at the end of the program and it should ends with format=mpd-time-csf and this indicates that you will be pulling a DASH stream. Without a player, you could paste the URL in IE, and choose to open the manifest. You should see something like this:


The highlighted Yellow box contains Widevine PSSH box with License URL you insert during the AssetDeliveryPolicyConfigurationKey configuration. For this manifest, we are setting up the URL points to our partner’s test server, however, it will appear “http://testurl” according to my sample code.

6. Configure Azure Media Player for your Widevine streams.
Azure Media Player v1.4.0 supports playback of Azure Media Services content that is dynamically packaged with both PlayReady and Widevine DRM. To get started, check out the documentation, or see the working samples for how to update the player for this configuration through JavaScript and directly through the DOM.

7. Here is a demo we set up to demonstrate playback of common encrypted stream with both PlayReady and Widevine header through Azure Media Player. Please choose DRM(PlayReady/Widevine) on demand or live stream, and open them on both IE and Chrome. You will see the stream gets to played on both of them with HTML5 MSE/EME APIs with PlayReady or Widevine accordingly.

8. If you don’t want to write code to configure Widevine, you could also use an awesome tool called Azure Media Explorer Tool. It added Widevine packaging configuration starting from version After you encoded a file into multiple bitrates Mp4, right click on the asset and select Security -> Add Dynamic encryption and key delivery policies for the asset…

9. Please choose Common encryption in step 1 and make sure DASH protocol is selected. In Step 2, select “Add Widevine Header”  to enable Widevine packaging, you could choose to put in a License delivery URL at the point, or override it on the player. Below is a printscreen to show how this tool looks like when configuring Widevine.

widevine_ExplorerLastly, if you are interested in setting up a 3rd party Widevine license services, you could email me at or reach out to our partners directly.


Leave a Reply

Your email address will not be published. Please enter your name, email and a comment.