CaseManagement.ReadWrite.All

Allows the app to read and write to all cases, relations, tasks, attachments and activities, on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the CaseManagement.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	57ac77a0-bb98-4ba8-bf9a-7af06dcdcc1f	363a0763-d7eb-40bc-9457-6be55acd81e2
DisplayText	Read and write to all cases, relations, tasks, attachments and activities	Read and write to all cases, relations, tasks, attachments and activities
Description	Allows the app to read and write to all cases, relations, tasks, attachments and activities, without a signed-in user.	Allows the app to read and write to all cases, relations, tasks, attachments and activities, on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /security/caseManagement/cases/{caseId}
	DELETE /security/caseManagement/cases/{caseId}/activities/{activityId}
	GET /security/caseManagement/cases
	GET /security/caseManagement/cases/{caseId}
	GET /security/caseManagement/cases/{caseId}/activities
	GET /security/caseManagement/cases/{caseId}/activities/{activityId}
	GET /security/caseManagement/cases/{caseId}/attachments
	GET /security/caseManagement/cases/{caseId}/attachments/{attachmentId}
	GET /security/caseManagement/cases/{caseId}/relations
	GET /security/caseManagement/cases/{caseId}/tasks
	GET /security/caseManagement/cases/{caseId}/tasks/{taskId}
	GET /security/caseManagement/caseTypeConfigurations
	GET /security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}
	GET /security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/customFields
	GET /security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/customFields/{customFieldDefinitionId}
	GET /security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/statuses
	GET /security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/statuses/{statusDefinitionId}
	PATCH /security/caseManagement/cases/{caseId}
	PATCH /security/caseManagement/cases/{caseId}/activities/{activityId}
	PATCH /security/caseManagement/cases/{caseId}/attachments/{attachmentId}
	PATCH /security/caseManagement/cases/{caseId}/relations/{relationId}
	PATCH /security/caseManagement/cases/{caseId}/tasks/{taskId}
	POST /security/caseManagement/cases
	POST /security/caseManagement/cases/{caseId}/activities
	POST /security/caseManagement/cases/{caseId}/attachments
	POST /security/caseManagement/cases/{caseId}/relations
	POST /security/caseManagement/cases/{caseId}/tasks

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: activity

Property	Type	Description
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.

Graph reference: attachment

Property	Type	Description
content	Stream	The binary content stream for the attachment.
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
description	String	The description of the attachment.
displayName	String	The display name of the attachment.
fileExtension	String	The file extension of the attachment.
fileSize	Int64	The size of the attachment in bytes.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
origin	microsoft.graph.security.caseManagement.attachmentOrigin	The origin reference for the attachment.
scanResult	microsoft.graph.security.caseManagement.attachmentScanResult	The malware scan result for the attachment.

Graph reference: attachmentOrigin

Property	Type	Description
resourceId	String	The identifier of the origin resource.
resourceType	microsoft.graph.security.caseManagement.attachmentOriginType	The type of origin resource.

Graph reference: auditLog

Property	Type	Description
action	microsoft.graph.security.caseManagement.auditAction	The action represented by the audit log activity.
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
details	microsoft.graph.security.caseManagement.activityResourceDetails	The target resource details for the audit activity.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
modifiedProperties	microsoft.graph.security.caseManagement.modifiedProperty collection	The collection of property changes recorded in the audit log.

Graph reference: security-casemanagement-case

Property	Type	Description
createdBy	String	The user or service that created the case. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`) and `$orderby`.
createdDateTime	DateTimeOffset	The date and time when the case was created. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`, `ge`, `le`) and `$orderby`.
customFields	microsoft.graph.security.caseManagement.customFieldValues	Tenant-defined custom field values keyed by custom field identifier.
displayName	String	The display name of the case. Supports `$filter` (`eq`, `ne`) and `$orderby`.
id	String	The unique identifier for the case. Inherited from entity. Supports `$filter` (`eq`, `ne`) and `$orderby`.
lastModifiedBy	String	The user or service that last modified the case. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`) and `$orderby`.
lastModifiedDateTime	DateTimeOffset	The date and time when the case was last modified. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`, `ge`, `le`) and `$orderby`.
status	String	The lifecycle status of the case, such as open, in progress, or closed. Supports `$filter` (`eq`, `ne`) and `$orderby`.

Graph reference: caseTypeConfiguration

Property	Type	Description
defaultStatusId	String	The id of the top-level status that a new case of this type starts in.
displayName	String	The human-readable label of the case type.
id	String	The unique identifier of the case type. The value is the case type name: `genericCase`, `incidentCase`, or `exposureCase`. Read-only.

Graph reference: comment

Property	Type	Description
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
message	String	The comment body.

Graph reference: customFieldDefinition

Property	Type	Description
description	String	The field description. Supports `$filter` and `$orderby`.
displayName	String	The field label shown on the case form. Supports `$filter` and `$orderby`.
id	String	The unique identifier of the custom field. Read-only. Supports `$filter` and `$orderby`.
isDisabled	Boolean	`true` if the field is disabled; otherwise, `false`. Supports `$filter` and `$orderby`.
isRequired	Boolean	`true` if a value is required for this field; otherwise, `false`. Supports `$filter` and `$orderby`.

Graph reference: dateTimeCustomFieldDefinition

Property	Type	Description
defaultDateTime	DateTimeOffset	The default date/time value applied to the field on a new case. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
description	String	The field description. Inherited from customFieldDefinition.
displayName	String	The field label shown on the case form. Inherited from customFieldDefinition.
id	String	The unique identifier of the custom field. Read-only. Inherited from customFieldDefinition.
isDisabled	Boolean	`true` if the field is disabled; otherwise, `false`. Inherited from customFieldDefinition.
isRequired	Boolean	`true` if a value is required for this field; otherwise, `false`. Inherited from customFieldDefinition.

Graph reference: genericCase

Property	Type	Description
assignedTo	String	The user assigned to the generic case.
closingNotes	String	Notes recorded when the generic case is closed.
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
customFields	microsoft.graph.security.caseManagement.customFieldValues	Tenant-defined custom field values keyed by custom field identifier. Inherited from case.
description	String	The description of the generic case.
displayName	String	The display name of the generic case. Inherited from case.
dueDateTime	DateTimeOffset	The target completion date and time for the generic case.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
priority	String	The priority assigned to the generic case.
status	String	The lifecycle status of the generic case. Inherited from case.

Graph reference: incidentCase

Property	Type	Description
aiAgentIds	String collection	The list of AI agent identifiers associated with the incident.
alertCounts	microsoft.graph.security.caseManagement.alertCounts	A summary of alert counts grouped by severity and status.
alertPolicyIds	String collection	The list of alert policy identifiers associated with the incident.
assignedTo	String	The user assigned to investigate the incident case.
associatedThreatIds	String collection	The list of threat identifiers associated with the incident.
categories	String collection	The incident categories.
classification	microsoft.graph.security.caseManagement.incidentClassification	The classification assigned to the incident.
cloudScopes	String collection	The cloud scopes associated with the incident.
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`) and `$orderby`.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`, `ge`, `le`) and `$orderby`.
customFields	microsoft.graph.security.caseManagement.customFieldValues	Tenant-defined custom field values keyed by custom field identifier. Inherited from case.
dataSensitivityLabels	String collection	The data sensitivity labels associated with the incident.
dataStreams	String collection	The data streams associated with the incident.
description	String	The description of the incident case.
detectionSources	String collection	The detection sources that identified the incident.
determination	microsoft.graph.security.caseManagement.incidentDetermination	The determination assigned to the incident.
displayName	String	The display name of the incident case. Inherited from case. Supports `$filter` (`eq`, `ne`) and `$orderby`.
dueDateTime	DateTimeOffset	The target completion date and time for the incident case.
emailNotificationRecipients	String collection	The email notification recipients for the incident case.
firstEventTime	DateTimeOffset	The date and time of the first event in the incident.
id	String	The unique identifier for the resource. Inherited from entity. Supports `$filter` (`eq`, `ne`) and `$orderby`.
impactedAssets	microsoft.graph.security.caseManagement.impactedAssetsCounts	A summary of impacted asset counts for the incident.
incidentId	Int64	The Microsoft Security incident identifier.
incidentWebUrl	String	The URL for the incident in the Microsoft Defender portal.
investigation	microsoft.graph.security.caseManagement.investigation	A summary of investigation details associated with the incident.
investigationIds	String collection	The list of investigation identifiers associated with the incident.
investigationStates	String collection	The list of investigation states associated with the incident.
lastEventTime	DateTimeOffset	The date and time of the most recent event in the incident.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`) and `$orderby`.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity. Supports `$filter` (`eq`, `ne`, `ge`, `le`) and `$orderby`.
machineGroupIds	String collection	The list of machine group identifiers associated with the incident.
osPlatforms	String collection	The operating system platforms associated with the incident.
policyNames	String collection	The policy names associated with the incident.
priorityScore	Int32	The priority score assigned to the incident.
productNames	String collection	The product names associated with the incident.
redirectCaseId	Int64	The case identifier to which this case redirects when merged.
redirectIncidentId	Int64	The incident identifier to which this incident redirects when merged.
serviceSources	String collection	The service sources associated with the incident.
severity	microsoft.graph.security.caseManagement.incidentSeverity	The severity assigned to the incident.
status	String	The lifecycle status of the incident case. Inherited from case. Supports `$filter` (`eq`, `ne`) and `$orderby`.
summary	String	A summary of the incident.
systemTags	String collection	The system tags associated with the incident.
topRiskScore	Int32	The top risk score associated with the incident.
workspaceIds	String collection	The list of workspace identifiers associated with the incident.

Graph reference: numberCustomFieldDefinition

Property	Type	Description
defaultValue	Int32	The default numeric value applied to the field on a new case.
description	String	The field description. Inherited from customFieldDefinition.
displayName	String	The field label shown on the case form. Inherited from customFieldDefinition.
id	String	The unique identifier of the custom field. Read-only. Inherited from customFieldDefinition.
isDisabled	Boolean	`true` if the field is disabled; otherwise, `false`. Inherited from customFieldDefinition.
isRequired	Boolean	`true` if a value is required for this field; otherwise, `false`. Inherited from customFieldDefinition.

Graph reference: optionsCustomFieldDefinition

Property	Type	Description
defaultValues	String collection	The option value or values selected by default on a new case.
description	String	The field description. Inherited from customFieldDefinition.
displayName	String	The field label shown on the case form. Inherited from customFieldDefinition.
id	String	The unique identifier of the custom field. Read-only. Inherited from customFieldDefinition.
isDisabled	Boolean	`true` if the field is disabled; otherwise, `false`. Inherited from customFieldDefinition.
isRequired	Boolean	`true` if a value is required for this field; otherwise, `false`. Inherited from customFieldDefinition.
options	String collection	The allowed option values a case author can choose from.

Graph reference: relation

Property	Type	Description
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
displayName	String	The human-friendly name for the linked resource.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
relatedResourceId	String	The identifier of the related external resource.

Graph reference: statusDefinition

Property	Type	Description
customStatuses	microsoft.graph.security.caseManagement.customStatusDefinition collection	The custom statuses returned inline within this top-level status. These aren't separately addressable.
displayName	String	The human-readable label of the status. Supports `$filter` and `$orderby`.
id	String	The unique identifier of the status within the case type. Read-only. Supports `$filter` and `$orderby`.
sortOrder	Int32	The display order of the status relative to other statuses of the same case type. Supports `$filter` and `$orderby`.

Graph reference: stringCustomFieldDefinition

Property	Type	Description
defaultValue	String	The default string value applied to the field on a new case.
description	String	The field description. Inherited from customFieldDefinition.
displayName	String	The field label shown on the case form. Inherited from customFieldDefinition.
id	String	The unique identifier of the custom field. Read-only. Inherited from customFieldDefinition.
isDisabled	Boolean	`true` if the field is disabled; otherwise, `false`. Inherited from customFieldDefinition.
isRequired	Boolean	`true` if a value is required for this field; otherwise, `false`. Inherited from customFieldDefinition.

Graph reference: security-casemanagement-task

Property	Type	Description
assignedTo	String	The user assigned to the task.
category	microsoft.graph.security.caseManagement.caseTaskCategory	The functional category of the task.
closingNotes	String	Notes recorded when the task is completed.
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
description	String	The description of the task.
displayName	String	The title of the task.
dueDateTime	DateTimeOffset	The target completion date and time for the task.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
priority	microsoft.graph.security.caseManagement.caseTaskPriority	The priority assigned to the task.
status	microsoft.graph.security.caseManagement.taskStatus	The lifecycle state of the task.

Table of Contents

CaseManagement.ReadWrite.All

Graph Methods

Resources