1. Right click on the output asset and choose Security / Add dynamic encryption and key delivery policies to the asset(s)…
2. For Protection choose Envelope clear key.
3. For Delivery I recommend checking Enable dynamic encryption and checking all three delivery protocol boxes (HLS, DASH, Smooth Streaming).
4. On the next dialog for AES Key Generation I recommend using Automatic generation (random content key).
5. On the next dialog if you have an external key server, feel free to use it, but it’s easier to use Azure Media Services for this.
6. Next set the Key Delivery From Azure Media Services to Yes and use only one policy.  Since you’re using AMS for the license acquisition you don’t need the Key Acquisition URL set.
7. With AES on the next dialog you have two options for the Content key’s authorization policy option.  The Open option does not require any authentication.  If you don’t care who views the video, but just want to encrypt it then this is the option to choose.  If you want to authenticate viewers then choose Token. That’s what we will focus on here.
8. In this example for the Token Type we will choose JWT – JSON Web Token with symmetric key.
9. For Token Properties set the issuer and audience.  Typically for the Issuer it will be your company’s web site.  The Audience or scope will be a subset of who you want to have access to the video.  This allows you to specify different groups that can have access.  For example, if you wanted only the marketing team to have access you could set it to urn:marketing assuming you have a way of providing a token only for people from the marketing team.
10. You can specify additional claims if you wish.

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cm46bWljcm9zb2Z0OmF6dXJlOm1lZGlhc2VydmljZXM6Y29udGVudGtleWlkZW50aWZpZXIiOiI5ODFkN2YzNC1iYmVhLTQ0MzgtYTVkMi1kZDkyNzQwYTYyYjciLCJpc3MiOiJodHRwOi8vZGJyaXN0b2wuY29udG9zby5jb20vIiwiYXVkIjoidXJuOmFsbGNvbXBhbnkiLCJleHAiOjE1MDQxMTYyMjZ9._WSfzDk5P23KjbAtJWdcEnr5L77t1OxkiIHbtYyjBRA

1. You validate that a user logged into your website has a valid account (simply by logging in).
2. You figure out what group / audience they’re part of if needed.
3. You build the token payload that includes the following fields: a. urn:microsoft:azure:mediaservices:contentkeyidentifier – (Required) This identifies specific key to unlock. Without this value the service would not know what to issue a key for. b. iss – (Optional) The issuer of the token. c. aud – (Optional) The audience / scope that I explained before. d. exp – (Optional) This is the JWT token expiration.  You should expire it, otherwise it could be reused by someone else. e. nbf – (Optional) This is essentially a start time, or “not before” time.  Used along with exp this gives you a time range that the JWT token is valid.
4. When generating the signature you just need to sign it based on the symmetric key of the asset.  If you’re in Azure Media Services Explorer, this is on step 3 of adding dynamic encryption to the asset on the dialog where you’re setting the Token Type, but on the Symmetric token key tab.  Because you are signing your token based on this key you will need to keep this in your database.  In AMSE you can get the symmetric key after encryption by double clicking on the asset, going to Content keys, selecting the Token option and clicking on the See key value button next to Primary Verification Key.

FoEn89xKyFYZaE8fwXL2CeMKodS+AdS6qsufwKn2pBJcG293EKJFCGThHXgWlEWrGXleMw9J4lz77fIQ9ACIvw==

• Not all clients / web servers are able to seek within the video.  Some may have to wait until the video is fully downloaded before they seek.  To support the seeking of video with progressive download both the client and server must support byte range offsets.  This is using the HTTP 'Accept-Ranges' server response and the client's 'Content-Range' request as per RFC 2616.
• Azure Media Services creates SAS URLs for links to blob storage as container based URLs, not blob URLs directly.  You can certainly link to a blob within the container though using the base URL of the container + the blob file name.
• Azure Media Services uses a signed identifier, the 'si' value, as the container policy ID so that the SAS URL can be revoked.
• There is a Storage limit of 5 policies per container.  This is why Azure Media Services is limited to 5 SAS URLs.
• The video that was progressively downloaded will be stored in client's browser cache (assuming it will fit).
• If you want to use a CDN for distributing SAS URL based videos you setup the CDN on the Blob Storage account.

• Video chunks, or sometimes called fragments, are sized to be the same as the GOP (Group of Pictures).
• When clients request video fragments the client makes a REST call for that specific fragment.  This includes details about the timestamp of the fragment as well as the bitrate.
• Because REST calls are used for fragments the response is easily cached on proxies or CDNs.
• Live streaming uses the same REST format as on demand streaming.
• To use dynamic packaging you must use at least one streaming unit on your Azure Media Services origin.
• If you want to use a CDN for distributing streaming URL based videos you setup the CDN on the Azure Media Services streaming endpoint.

In the web portal:

We are unable to connect to the content you've requested.  We apologize for the inconvenience.
A network error caused the video download to fail part-way.  ExtendedMessage: An error has occurred while downloading the manifest.

If you try browsing to the manifest directly or you use a network trace tool to monitor the manifest request you see the error:

500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.

When you see these errors the most likely cause is that you do not have a Streaming Unit for the dynamically packaged video content.

Dynamic Packaging is a technology that Azure Media Services uses that allows you to create a single video asset and have that asset streamed over the Smooth Streaming, HLS, and MPEG-DASH protocols.  In the past when you created a video asset you could only stream that video asset using the protocol specific to the format that it was encoded as.  For example, if you encoded an asset as Smooth Streaming you would get a group of ISMV video files that made up that asset.  The server would only be able to deliver those videos over the Smooth Streaming protocol.  If you wanted to stream over HLS or another protocol you had to encode another video asset with the MPEG-2 TS files that HLS used to stream over that protocol.  Dynamic Packaging allows you to create a single Adaptive Bitrate MP4 set and from that one asset deliver content over a number of different protocols.  With Azure Media Services this repackaging is done at browse time for each client.  Because this takes extra work, a Streaming Unit is required to use this feature.  For an overview of how to use Dynamic Packaging, see https://azure.microsoft.com/en-us/documentation/articles/media-services-dynamic-packaging-overview/.

Use the follow steps to enable a Streaming Unit:

1. Open the web portal for Azure Media Services and got to the STREAMING ENDPOINTS tab.  If you have at least one Streaming Unit then the issue you are seeing is not related to this article.
   
2. Click the arrow beside 'default' to open your streaming endpoint.
3. Move the STREAMING UNITS slider to the right so that you have at least one streaming unit.  Note: this will have a pricing impact on your account.  Please review https://go.microsoft.com/fwLink/?LinkID=309724&clcid=0x409 for the cost of streaming units.  Save the changes.
   

It will take a few minutes for the Streaming Unit to be active.  Once it is active you should no longer see the playback error.

On step 4 of the installation guide it mentions enabling execute permissions on the virtual root.  To do this:

1. Open the Handler Mappings module on the virtual directory. 
2. Select the ISAPI-dll mapping and choose Edit Feature Permissions...
3. Check the Execute box and choose OK.
4. Additionally, with the ISAPI-dll still highlighted, choose Edit...
5. For the executable, point to the path of the wmsiislog.dll and choose OK.

At this point if you make a test the path to the DLL by opening a browser and requesting http://web_server_name/virtual_directory_name/wmsiislog.dllyou should get a response of:

WMS ISAPI Log Dll/9.6.7600.16564

This will confirm that the dll is executing correctly.  Create a multicast and ensure that you are getting log files in the %windir%\System32\LogFiles\WMS_ISAPI folder.  If no files are present after playing several multicast streams you may need to change the permissions on this folder.  The To do this:

1. Right click on the WMS_ISAPI folder and go to Properties / Security. 
2. Click on Advanced.  Go to the Owner tab.  Click Edit...
3. Select the administrative account you are logged in as to be the owner.  Click several OK several times until you are back to the Security tab.
4. Click on Advanced once again.  On the Advanced Security Settings for WMS_ISAPI dialog click Change Permissions... 
5. Check the box for Replace all child object permissions... and click on Add...
6. For the account name use the <machine name>\IUSR and click OK.
7. For the permissions choose everything except for Full control and Change permissions.
8. Click OK until all dialogs are closed. 

Keep in mind that if the log file is listed as 0 bytes initially it is because the ISAPI dll will buffer writing to the file.  Wait a few minutes and you should see the contents of the log.

If you truly have no programs when you go into the PROGRAMS section you should a message saying, “You have no programs.”

However, if you have programs but they are not listed then you get the message, “No programs could be found that match the filters you provided.”  By default the when you open the PROGRAMS list it will only list programs that were created in the last 24 hours.

If you change the query time to include a bit more time, or at least as long as you think you may have had the program round you will find the program(s).

Now that you can see all of the programs, you can delete them so that you can delete the channel.

A more detailed workflow on the previous behavior world be something like:

1. Visit https://manage.windowsazure.com/ and go to Azure Media Services.
2. Select the account you want to use and go to the CONTENT tab.
3. Assuming you have a MP4 video asset already listed, you click on the PUBLISH button.
4. You get a URL similar to https://<AccountName>.blob.core.windows.net/asset-12345678-9abc-def1-2345-6789abcdef12/video.mp4?st=2014-09-17T04%3A47%3A25Z&se=2015-09-17T04%3A47%3A25Z&sr=c&si=3456789a-bcde-f123-4567-89abcdef1234&sig=n0Yc1jQzRshaJbOhM2WhMgztKNZUvtyf03NGv6IAMslE%3D

Changed behavior

1. Visit https://manage.windowsazure.com/ and go to Azure Media Services.
2. Select the account you want to use and go to the CONTENT tab.
3. Assuming you have a MP4 video asset already listed, you click on the PUBLISH button.
4. You get a URL similar to http://<AccountName>.origin.mediaservices.windows.net/12345678-9abc-def1-2345-6789abcdef12/video.ism/Manifest

The reason for this change is that it is possible to stream the single MP4 video asset as a dynamically packaged video using the HLS, Smooth Streaming, and MPEG-DASH formats.  Typically this type of streaming is done with multiple MP4 files that are encoded at different bitrates for the video asset, but it is possible to use only a single bitrate.  When you encode a video with the Azure Media Encoder a manifest is created.  If this manifest is present an origin URL will be created instead of a SAS URL.  MP4 videos that are uploaded and published without encoding on Azure Media Encoder will not have this manifest so a standard SAS URL is generated.  For more information on dynamic packaging see http://msdn.microsoft.com/library/azure/jj889436.aspx.

Workarounds
If you still wish to use a SAS URL for your single file Azure Media Services encoded MP4 asset then it is recommended that you use the Azure Media Services SDK to specifically set the locator to be a SAS URL.

See http://msdn.microsoft.com/en-us/library/azure/jj129575.aspx for more info on creating a SAS URL through code.

Additionally, you can use the Azure Media Services Explorer which you can get from https://github.com/Azure/Azure-Media-Services-Explorer/releases/latest to publish the URL.

After processing a large number of videos with the Windows Azure Media Encoder you may see an error in the portal that says, "This account has reached the limit of 50,000 jobs."  You see this error when you try to submit a new job.  If you are using the REST API or the .Net SDK you see a return of ServiceUnavailable when submitting a job. 

There is a record limit of 50,000 jobs within Windows Azure Media Encoder.  You must delete historic job records occasionally to clear up space for new job records. 

Sample Code to Delete Finished Jobs

This C# command line sample code will delete all finished jobs from a single Media Services account.  The only parameters that you have to pass are the Media Services account name and key.  The sample only deletes jobs that finished (JobState.Finished).  If you wish to delete cancelled jobs or jobs that ended with an error, use JobState.Canceled or JobState.Error respectively for the job state.

using System;
using System.Text;
using Microsoft.WindowsAzure.MediaServices.Client; 

namespace DeleteJobs
{
    class Program
    {
        private static CloudMediaContext _context = null;
        static void Main(string[] args)
        {
            if (args.Length != 2)
            {
                DisplayUsage();
                return;
            }

            Console.Clear();
            Console.WriteLine("Are you sure you want to delete ALL finished jobs?");
            Console.WriteLine("Y/N");
            if (!(Console.ReadKey().Key == ConsoleKey.Y))
            {
                return;
            }

            string accountName = args[0].ToString();
            string accountKey = args[1].ToString();
             _context = new CloudMediaContext(accountName, accountKey); 

            foreach (IJob job in _context.Jobs)
            {
                if (job.State == JobState.Finished)
                {
                    Console.WriteLine("Deleting job {0}", job.Id);
                    job.Delete();
                }
            }
        } 

        static void DisplayUsage()
        {
            Console.Out.WriteLine("\nDeleteFinishedJobs.exe will delete all finished jobs.  There is a limit of");
            Console.Out.WriteLine("50,000 jobs that are allowed to remain in a single Media Services account.");
            Console.Out.WriteLine("Jobs that are processing, queued, or errored out are not deleted.");
            Console.Out.WriteLine("\nUsage:");
            Console.Out.WriteLine("DeleteFinishedJobs.exe <account name> <account key>");
            Console.Out.WriteLine("\n\nExample:\nDeleteJobs.exe testAcct AbCdEfGhIjKlMnOpQrStUvWxYz1234567890=");
        }
    }
} 

For more information on the quotas and limitations of Windows Azure Media Services see http://msdn.microsoft.com/en-us/library/jj945161.aspx.