dotnet/wpf · error · RightsManagementException

NeedsGroupIdentityActivation

NeedsGroupIdentityActivation

Error message

RightsManagementFailureCode.NeedsGroupIdentityActivation

What it means

SecureEnvironment.Create checks whether the given user is already activated for this machine (IsUserActivated). If not, it throws RightsManagementException with FailureCode.NeedsGroupIdentityActivation instead of silently activating. The caller must use the (applicationManifest, AuthenticationType, UserActivationMode) overload of Create to run activation first.

Solutions

Call the other overload SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent) first to activate, then Create(manifest, user)
Check SecureEnvironment.IsUserActivated(user) before Create and branch to the activation flow
Persist activation state expectations in your app: on NeedsGroupIdentityException, prompt and activate rather than crash
Use UserActivationMode.Temporary if per-session activation is acceptable and you want no machine-state change

Example fix

// before
var env = SecureEnvironment.Create(manifest, user); // throws if not activated

// after
if (!SecureEnvironment.IsUserActivated(user))
{
    var activatingEnv = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);
    activatingEnv.Dispose();
}
var env = SecureEnvironment.Create(manifest, user);

Defensive patterns

Strategy: try-catch

Validate before calling

bool ready = SecureEnvironment.IsUserActivated(user);
if (!ready)
{
    using var temp = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);
    // user now activated
}

Type guard

static bool IsReadyToBind(SecureEnvironment _) => true; // guard instead:
static bool NeedsActivation(ContentUser u) => !SecureEnvironment.IsUserActivated(u);

Try / catch

try { var env = SecureEnvironment.Create(manifest, user); }
catch (RightsManagementException ex) when (ex.FailureCode == RightsManagementFailureCode.NeedsGroupIdentityActivation)
{
    // activate once, then retry Create
    using var activating = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);
    var env = SecureEnvironment.Create(manifest, user);
}

Prevention

Always probe IsUserActivated before Create(manifest, user)
Handle first-run activation in application startup, not at the point of consuming content
After RemoveActivatedUser or machine changes, expect to re-activate

When it happens

Trigger: Calling SecureEnvironment.Create(manifest, user) on a machine where the user (or the machine) has never been activated — first run of the app, after RemoveActivatedUser, on a new machine or new user profile, or after RM store corruption.

Common situations: Deploying an app that skips the activation flow; a user switching domains/accounts; cleaning RM state in troubleshooting and forgetting to re-activate.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/647e2ab6ebc6c095. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs:247

        /// <summary>
        /// This static Method builds a new instance of a secure environment for a given user that is assumed to be already activated. 
        /// client Application can use GetActivatedUsers property to enumerate Activated users.
        /// </summary>
        private static SecureEnvironment CriticalCreate(string applicationManifest, ContentUser user)
        {
            ArgumentNullException.ThrowIfNull(applicationManifest);
            ArgumentNullException.ThrowIfNull(user);

            // we only let specifically identifyed users to be used here  
            if ((user.AuthenticationType != AuthenticationType.Windows) && 
                 (user.AuthenticationType != AuthenticationType.Passport))
            {
                throw new ArgumentOutOfRangeException(nameof(user));
            }

            if (!IsUserActivated(user))
            {
                throw new RightsManagementException(RightsManagementFailureCode.NeedsGroupIdentityActivation);
            }
            
            ClientSession clientSession = new ClientSession(user);

            try
            {
                clientSession.BuildSecureEnvironment(applicationManifest);

                return new SecureEnvironment(applicationManifest, user, clientSession);
            }
            catch
            {
                clientSession.Dispose();
                throw;
            }
        }

        private static SecureEnvironment CriticalCreate(

View on GitHub (pinned to 81131a70a4)