The client sends the challenge to the License Server. The server decrypts the challenge, verifies the device's authenticity, and checks if the user meets the business rules (e.g., active subscription, geographic compliance).

Applications use the W3C standard Encrypted Media Extensions (EME) API to pass license challenges and responses to the built-in PlayReady CDM.

When a player encounters PlayReady-protected content, it cannot decode the video frames immediately. Instead, it extracts the PRO and initiates the decryption workflow:

The client’s private key is used to decrypt the CEK. This key then decrypts the actual media frames (typically using AES-128 CTR or CBC modes) for immediate playback. Security Levels (SL)

PlayReady and Other Protection Technologies - Microsoft Learn