eDiscovery.Read.All
Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.
Merill's Note
For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the
eDiscovery.Read.All
permission.If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the
Export-MsIdAppConsentGrantReport
command. See How To: Run a quick OAuth app audit of your tenant
Category | Application | Delegated |
---|---|---|
Identifier | 50180013-6191-4d1e-a373-e590ff4e66af | 99201db3-7652-4d5a-809a-bdb94f85fe3c |
DisplayText | Read all eDiscovery objects | Read all eDiscovery objects |
Description | Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user. | Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user. |
AdminConsentRequired | Yes | Yes |
Graph Methods
→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)
Methods | |
---|---|
→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)
Methods | |
---|---|
→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)
Commands | |
---|---|
→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)
Commands | |
---|---|
Resources
Granting this permission allows the calling application to access (and/or update) the following information in your tenant.
- addToReviewSetOperation
- case
- caseExportOperation
- caseOperation
- custodian
- dataSource
- estimateStatisticsOperation
- legalHold
- noncustodialDataSource
- reviewSet
- reviewSetQuery
- siteSource
- sourceCollection
- tag
- unifiedGroupSource
- userSource
- caseOperation
- dataSource
- ediscoveryAddToReviewSetOperation
- ediscoveryCase
- ediscoveryCaseSettings
- ediscoveryCustodian
- ediscoveryEstimateOperation
- ediscoveryExportOperation
- ediscoveryFile
- ediscoveryHoldOperation
- ediscoveryHoldPolicy
- ediscoveryIndexOperation
- ediscoveryNoncustodialDataSource
- ediscoveryReviewSet
- ediscoveryReviewSetQuery
- ediscoveryReviewTag
- ediscoverySearch
- ediscoverySearchExportOperation
- siteSource
- unifiedGroupSource
- userSource
Graph reference: addToReviewSetOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.ediscovery.caseAction | The case action for this entity will always be addToReviewSet . Read-only. Inherited from caseOperation. |
completedDateTime | DateTimeOffset | The date and time the operation was completed. Read-only. Inherited from caseOperation |
createdBy | identitySet | The user who created the operation. Read-only. Inherited from caseOperation |
createdDateTime | DateTimeOffset | The date and time the operation was started. Read-only. Inherited from caseOperation |
id | String | The ID for the operation. Read-only. Inherited from caseOperation. |
percentProgress | Int32 | The progress of the operation. Read-only. Inherited from caseOperation. |
resultInfo | resultInfo | Contains success and failure-specific result information. Inherited from caseOperation. |
status | microsoft.graph.ediscovery.caseOperationStatus | The status of the case operation. Inherited from caseOperation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: case
Property | Type | Description |
---|---|---|
closedBy | identitySet | The user who closed the case. |
closedDateTime | DateTimeOffset | The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
createdBy | identitySet | The user who created the case. |
createdDateTime | DateTimeOffset | The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
description | String | The case description. |
displayName | String | The case name. |
externalId | String | The external case number for customer reference. |
id | String | The ID for the eDiscovery case. Read-only. |
lastModifiedBy | identitySet | The last user who modified the entity. |
lastModifiedDateTime | DateTimeOffset | The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
status | microsoft.graph.ediscovery.caseStatus | The case status. Possible values are unknown , active , pendingDelete , closing , closed , and closedWithError . For details, see the following table. |
Graph reference: caseExportOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.ediscovery.caseAction | The case action for this entity will always be contentExport . Inherited from caseOperation. |
azureBlobContainer | String | The name of the Azure storage location where the export will be stored. This only applies to exports stored in your own Azure storage location. |
azureBlobToken | String | The SAS token for the Azure storage location. This only applies to exports stored in your own Azure storage location. |
completedDateTime | DateTimeOffset | The date and time the export was completed. Inherited from caseOperation. |
createdBy | identitySet | The user who initiated the export operation. Inherited from caseOperation. |
createdDateTime | DateTimeOffset | The date and time the export was created. Inherited from caseOperation. |
description | String | The description provided for the export. |
exportOptions | microsoft.graph.ediscovery.exportOptions | The options provided for the export. For more information, see reviewSet: export. Possible values are: originalFiles , text , pdfReplacement , fileInfo , tags . |
exportStructure | microsoft.graph.ediscovery.exportFileStructure | The options provided specify the structure of the export. For more information, see reviewSet: export. Possible values are: none , directory , pst . |
id | String | The ID for the operation. Read-only. Inherited from caseOperation. |
outputFolderId | String | The output folder ID. |
outputName | String | The name provided for the export. |
percentProgress | Int32 | The progress of the operation. Inherited from caseOperation. |
resultInfo | resultInfo | Contains success and failure-specific result information. Inherited from caseOperation. |
status | microsoft.graph.ediscovery.caseOperationStatus | The status of the case operation. Inherited from caseOperation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: caseOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.ediscovery.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the operation was completed. |
createdBy | identitySet | The user that created the operation. |
createdDateTime | DateTimeOffset | The date and time the operation was created. |
id | String | The ID for the operation. Read-only. |
percentProgress | Int32 | The progress of the operation. |
resultInfo | resultInfo | Contains success and failure-specific result information. |
status | microsoft.graph.ediscovery.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: custodian
Property | Type | Description |
---|---|---|
acknowledgedDateTime | DateTimeOffset | Date and time the custodian acknowledged a hold notification. |
applyHoldToSources | Boolean | Identifies whether a custodian's sources were placed on hold during creation. |
createdDateTime | DateTimeOffset | Date and time when the custodian was added to the case. |
displayName | String | Display name of the custodian. |
String | Email address of the custodian. | |
id | String | The ID for the custodian in the specified case. Read-only. |
lastModifiedDateTime | DateTimeOffset | Date and time the custodian object was last modified |
releasedDateTime | DateTimeOffset | Date and time the custodian was released from the case. |
status | microsoft.graph.ediscovery.custodianStatus | Status of the custodian. Possible values are: active , released . |
Graph reference: dataSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the dataSource. |
createdDateTime | DateTimeOffset | The date and time the dataSource was created. |
displayName | String | The display name of the dataSource, and is the name of the SharePoint site. |
id | String | The ID of the **d |
Graph reference: estimateStatisticsOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.ediscovery.caseAction | The type of operation. The case action for this entity will always be estimateStatistics . Read-only. Inherited from caseOperation. |
completedDateTime | DateTimeOffset | The date and time the operation was completed. Read-only. Inherited from caseOperation. |
createdBy | identitySet | The user who created the operation. Read-only. Inherited from caseOperation. |
createdDateTime | DateTimeOffset | The date and time the operation was started. Read-only. Inherited from caseOperation. |
id | String | The ID for the operation. Read-only. Inherited from caseOperation. |
indexedItemCount | Int64 | The estimated count of items for the sourceCollection that matched the content query. |
indexedItemsSize | Int64 | The estimated size of items for the sourceCollection that matched the content query. |
mailboxCount | Int32 | The number of mailboxes that had search hits. |
percentProgress | Int32 | The progress of the operation. Read-only. Inherited from caseOperation. |
resultInfo | resultInfo | Contains success and failure-specific result information. Inherited from caseOperation. |
siteCount | Int32 | The number of mailboxes that had search hits. |
status | microsoft.graph.ediscovery.caseOperationStatus | The status of the case operation. Inherited from caseOperation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
unindexedItemCount | Int64 | The estimated count of unindexed items for the collection. |
unindexedItemsSize | Int64 | The estimated size of unindexed items for the collection. |
Graph reference: legalHold
Property | Type | Description |
---|---|---|
contentQuery | String | KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank. |
createdBy | identitySet | The user who created the legal hold. |
createdDateTime | DateTimeOffset | The date and time the legal hold was created. |
description | String | The legal hold description. |
displayName | String | The display name of the legal hold. |
errors | String collection | Lists any errors that happened while placing the hold. |
id | String | The ID for the eDiscovery case. Read-only. Inherited from entity. |
isEnabled | Boolean | Indicates whether the hold is enabled and actively holding content. |
lastModifiedBy | identitySet | the user who last modified the legal hold. |
lastModifiedDateTime | DateTimeOffset | The date and time the legal hold was last modified. |
status | microsoft.graph.ediscovery.legalHoldStatus | The status of the legal hold. Possible values are: Pending , Error , Success , UnknownFutureValue . |
Graph reference: noncustodialDataSource
Property | Type | Description |
---|---|---|
applyHoldToSource | Boolean | Indicates if hold is applied to noncustodial data source (such as mailbox or site). |
createdDateTime | DateTimeOffset | Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
displayName | String | Display name of the noncustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
id | String | Unique identifier of the nonCustodialDataSource. Inherited from entity. |
lastModifiedDateTime | DateTimeOffset | Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
releasedDateTime | DateTimeOffset | Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
status | microsoft.graph.ediscovery.dataSourceContainerStatus | Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. Possible values are: Active , Released . |
Graph reference: reviewSet
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the review set. Read-only. |
createdDateTime | DateTimeOffset | The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . Read-only. |
displayName | String | The review set name. The name is unique with a maximum limit of 64 characters. |
id | String | The review set unique identifier. Read-only. |
Graph reference: reviewSetQuery
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the query. |
createdDateTime | DateTimeOffset | The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
displayName | String | The name of the query. |
id | String | The unique identifier of the query. Read-only. |
lastModifiedBy | identitySet | The user who last modified the query. |
lastModifiedDateTime | DateTimeOffset | The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
query | String | The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in Advanced eDiscovery. This field maps directly to the keywords condition. You can refine searches by using fields listed in the *s |
Graph reference: siteSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the siteSource. |
createdDateTime | DateTimeOffset | The date and time the siteSource was created. |
displayName | String | The display name of the siteSource. This will be the name of the SharePoint site. |
id | String | The ID of the **s |
Graph reference: sourceCollection
Property | Type | Description |
---|---|---|
contentQuery | String | The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016. |
createdBy | identitySet | The user who created the sourceCollection. |
createdDateTime | DateTimeOffset | The date and time the sourceCollection was created. |
dataSourceScopes | microsoft.graph.ediscovery.dataSourceScopes | When specified, the collection spans across a service for an entire workload. Possible values are: none , allTenantMailboxes , allTenantSites , allCaseCustodians , allCaseNoncustodialDataSources . |
description | String | The description of the sourceCollection. |
displayName | String | The display name of the sourceCollection. |
id | String | The ID for the sourceCollection. Read-only. |
lastModifiedBy | identitySet | The last user who modified the sourceCollection. |
lastModifiedDateTime | DateTimeOffset | The last date and time the **s |
Graph reference: tag
Property | Type | Description |
---|---|---|
childSelectability | microsoft.graph.ediscovery.childSelectability | Indicates whether a single or multiple child tags can be associated with a document. Possible values are: One , Many . This value controls whether the UX presents the tags as checkboxes or a radio button group. |
createdBy | identitySet | The user who created the tag. |
description | String | The description for the tag. |
displayName | String | Display name of the tag. |
id | String | Unique identifier for the tag. |
lastModifiedDateTime | DateTimeOffset | The date and time the tag was last modified. |
Graph reference: unifiedGroupSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the unifiedGroupSource. |
createdDateTime | DateTimeOffset | The date and time the unifiedGroupSource was created. |
displayName | String | The display name of the unified group - This is the name of the group. |
id | String | The ID of the unifiedGroupSource. This isn't the ID of the actual group. |
includedSources | microsoft.graph.ediscovery.sourceType | Specifies which sources are included in this group. Possible values are: mailbox , site . |
Graph reference: userSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the userSource. |
createdDateTime | DateTimeOffset | The date and time the userSource was created |
displayName | String | The display name associated with the mailbox and site. |
String | Email address of the user's mailbox. | |
id | String | The ID of the userSource. This is not the ID of the actual group |
includedSources | microsoft.graph.ediscovery.sourceType | Specifies which sources are included in this group. Possible values are: mailbox , site . |
siteWebUrl | String | The URL of the user's OneDrive for Business site. Read-only. |
Graph reference: caseOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the operation was completed. |
createdBy | identitySet | The user that created the operation. |
createdDateTime | DateTimeOffset | The date and time the operation was created. |
id | String | The ID for the operation. Read-only. |
percentProgress | Int32 | The progress of the operation. |
resultInfo | resultInfo | Contains success and failure-specific result information. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: dataSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the dataSource. |
createdDateTime | DateTimeOffset | The date and time the dataSource was created. |
displayName | String | The display name of the dataSource and is the name of the SharePoint site. |
holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the dataSource.The possible values are: notApplied , applied , applying , removing , partial |
id | String | The ID of the **d |
Graph reference: ediscoveryAddToReviewSetOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the operation was completed. |
createdBy | identitySet | The user that created the operation. |
createdDateTime | DateTimeOffset | The date and time the operation was created. |
id | String | The ID for the operation. Read-only. |
percentProgress | Int32 | The progress of the operation. |
resultInfo | resultInfo | Contains success and failure-specific result information. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: ediscoveryCase
Property | Type | Description |
---|---|---|
closedBy | microsoft.graph.identitySet | The user who closed the case. |
closedDateTime | DateTimeOffset | The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
createdBy | microsoft.graph.identitySet | The user who created the case. |
createdDateTime | DateTimeOffset | The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
description | String | The case description. |
displayName | String | The case name. |
externalId | String | The external case number for customer reference. |
id | String | The ID for the eDiscovery case. Read-only. |
lastModifiedBy | microsoft.graph.identitySet | The last user who modified the case. |
lastModifiedDateTime | DateTimeOffset | The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
status | microsoft.graph.security.caseStatus | The case status. Possible values are unknown , active , pendingDelete , closing , closed , and closedWithError . For details, see the following table. |
Graph reference: ediscoveryCaseSettings
Property | Type | Description |
---|---|---|
id | String | The ID of the eDiscovery case. Inherited from entity. |
ocr | microsoft.graph.security.ocrSettings | The OCR (Optical Character Recognition) settings for the case. |
redundancyDetection | microsoft.graph.security.redundancyDetectionSettings | The redundancy (near duplicate and email threading) detection settings for the case. |
topicModeling | microsoft.graph.security.topicModelingSettings | The Topic Modeling (Themes) settings for the case. |
Graph reference: ediscoveryCustodian
Property | Type | Description |
---|---|---|
acknowledgedDateTime | DateTimeOffset | Date and time the custodian acknowledged a hold notification. |
createdDateTime | DateTimeOffset | Date and time when the custodian was added to the case. |
displayName | String | Display name of the custodian. |
String | Email address of the custodian. | |
holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the custodian.The possible values are: notApplied , applied , applying , removing , partial |
id | String | The ID for the custodian in the specified case. Read-only. |
lastModifiedDateTime | DateTimeOffset | Date and time the custodian object was last modified |
releasedDateTime | DateTimeOffset | Date and time the custodian was released from the case. |
status | microsoft.graph.security.custodianStatus | Status of the custodian. Possible values are: active , released . |
Graph reference: ediscoveryEstimateOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the operation was completed. Read-only. |
createdBy | identitySet | The user who created the operation. Read-only. |
createdDateTime | DateTimeOffset | The date and time the operation was started. Read-only. |
id | String | The ID for the operation. Read-only. |
indexedItemCount | Int64 | The estimated count of items for the search that matched the content query. |
indexedItemsSize | Int64 | The estimated size of items for the search that matched the content query. |
mailboxCount | Int32 | The number of mailboxes that had search hits. |
percentProgress | Int32 | The progress of the operation. Read-only. |
resultInfo | resultInfo | Contains success and failure-specific result information. |
siteCount | Int32 | The number of mailboxes that had search hits. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
unindexedItemCount | Int64 | The estimated count of unindexed items for the collection. |
unindexedItemsSize | Int64 | The estimated size of unindexed items for the collection. |
Graph reference: ediscoveryExportOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the export was completed. |
createdBy | identitySet | The user who initiated the export operation. |
createdDateTime | DateTimeOffset | The date and time the export was created. |
description | String | The description provided for the export. |
exportFileMetadata | microsoft.graph.security.ediscoveryExportFileMetadata | Contains the properties for an export file metadata, including downloadUrl, fileName, and size. |
exportOptions | microsoft.graph.security.exportOptions | The options provided for the export. For more information, see reviewSet: export. Possible values are: originalFiles , text , pdfReplacement , tags . |
exportStructure | microsoft.graph.security.exportFileStructure | The options that specify the structure of the export. For more information, see reviewSet: export. Possible values are: none , directory , pst . |
id | String | The ID for the operation. Read-only. |
outputName | String | The name provided for the export. |
percentProgress | Int32 | The progress of the operation. |
resultInfo | resultInfo | Contains success and failure-specific result information. Inherited from caseOperation. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: ediscoveryFile
Property | Type | Description |
---|---|---|
content | Stream | The content stream of the original file. |
dateTime | DateTimeOffset | The date and time the file was last modified. See dateTime values for more details. |
extension | String | The file extension of the file such as png, msg, docx etc. |
extractedTextContent | Stream | The extracted text from the original file. For image based files, this would be the OCR text. |
id | String | The unique identifier for the file. |
mediaType | String | mimeType of the file. for example: text/plain, charset=UTF-8, application/vnd.ms-outlook. |
name | String | The name of the file. Subject of the mail for email. |
otherProperties | microsoft.graph.security.stringValueDictionary | A list of other properties of the file like titleOfSharepointDocument, emailRecipients. Learn more. |
processingStatus | microsoft.graph.security.fileProcessingStatus | The processing status after the item was added to a review set. The possible values are: success , internalError , unknownError , processingTimeout , invalidFileId , fileSizeIsZero , fileSizeIsTooLarge , fileDepthLimitExceeded , fileBodyIsTooLong , fileTypeIsUnknown , fileTypeIsNotSupported , malformedFile , protectedFile , poisonFile , noReviewSetSummaryGenerated , extractionException , ocrProcessingTimeout , ocrFileSizeExceedsLimit . |
senderAuthor | String collection | The sender of the email or authors of the document. |
size | Int64 | size of the file. |
sourceType | microsoft.graph.security.sourceType | The original source of the content. The possible values are: mailbox , site . |
subjectTitle | String | The subject of the email or title of the document |
Graph reference: ediscoveryHoldOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the operation was completed. |
createdBy | identitySet | The user that created the operation. |
createdDateTime | DateTimeOffset | The date and time the operation was created. |
id | String | The ID for the operation. Read-only. |
percentProgress | Int32 | The progress of the operation. |
resultInfo | resultInfo | Contains success and failure-specific result information. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: ediscoveryHoldPolicy
Property | Type | Description |
---|---|---|
contentQuery | String | KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank. |
createdBy | identitySet | The user who created the legal hold. |
createdDateTime | DateTimeOffset | The date and time the legal hold was created. |
description | String | The legal hold description. |
displayName | String | The display name of the legal hold. |
errors | String collection | Lists any errors that happened while placing the hold. |
id | String | The ID for the eDiscovery case. Read-only. Inherited from entity. |
isEnabled | Boolean | Indicates whether the hold is enabled and actively holding content. |
lastModifiedBy | identitySet | the user who last modified the legal hold. |
lastModifiedDateTime | DateTimeOffset | The date and time the legal hold was last modified. |
status | microsoft.graph.security.policyStatus | The status of the legal hold. Possible values are: Pending , Error , Success . |
Graph reference: ediscoveryIndexOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime | DateTimeOffset | The date and time the operation was completed. |
createdBy | identitySet | The user that created the operation. |
createdDateTime | DateTimeOffset | The date and time the operation was created. |
id | String | The ID for the operation. Read-only. |
percentProgress | Int32 | The progress of the operation. |
resultInfo | resultInfo | Contains success and failure-specific result information. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Graph reference: ediscoveryNoncustodialDataSource
Property | Type | Description |
---|---|---|
createdDateTime | DateTimeOffset | Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. |
displayName | String | Display name of the noncustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. |
holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the nonCustodialDataSource. The possible values are: notApplied , applied , applying , removing , partial |
id | String | Unique identifier of the nonCustodialDataSource. Inherited from entity. |
lastModifiedDateTime | DateTimeOffset | Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. |
releasedDateTime | DateTimeOffset | Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.security.datasourcecontainer. |
status | microsoft.graph.security.dataSourceContainerStatus | Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. Possible values are: Active , Released . |
Graph reference: ediscoveryReviewSet
Property | Type | Description |
---|---|---|
createdBy | microsoft.graph.identitySet | The user who created the review set. Read-only. |
createdDateTime | DateTimeOffset | The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . Read-only. |
displayName | String | The review set name. The name is unique with a maximum limit of 64 characters. |
id | String | The review set unique identifier. Read-only. |
Graph reference: ediscoveryReviewSetQuery
Property | Type | Description |
---|---|---|
contentQuery | String | The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in eDiscovery (Premium). This field maps directly to the keywords condition. You can refine searches by using fields listed in the searchable field name paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016. |
createdBy | identitySet | The user who created the query. |
createdDateTime | DateTimeOffset | The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
description | String | The description of the eDiscovery search. |
displayName | String | The name of the query. |
id | String | The unique identifier of the query. Read-only. |
lastModifiedBy | identitySet | The user who last modified the query. |
lastModifiedDateTime | DateTimeOffset | The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
Graph reference: ediscoveryReviewTag
Property | Type | Description |
---|---|---|
childSelectability | microsoft.graph.security.childSelectability | Indicates whether a single or multiple child tags can be associated with a document. Possible values are: One , Many . This value controls whether the UX presents the tags as checkboxes or a radio button group. |
createdBy | identitySet | The user who created the tag. |
description | String | The description for the tag. |
displayName | String | Display name of the tag. |
id | String | Unique identifier for the tag. |
lastModifiedDateTime | DateTimeOffset | The date and time the tag was last modified. |
Graph reference: ediscoverySearch
Property | Type | Description |
---|---|---|
contentQuery | String | The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016. |
createdBy | identitySet | The user who created the eDiscovery search. |
createdDateTime | DateTimeOffset | The date and time the eDiscovery search was created. |
dataSourceScopes | microsoft.graph.security.dataSourceScopes | When specified, the collection spans across a service for an entire workload. Possible values are: none , allTenantMailboxes , allTenantSites , allCaseCustodians , allCaseNoncustodialDataSources . |
description | String | The description of the eDiscovery search. |
displayName | String | The display name of the eDiscovery search. |
id | String | The ID for the eDiscovery search. Read-only. |
lastModifiedBy | identitySet | The last user who modified the eDiscovery search. |
lastModifiedDateTime | DateTimeOffset | The last date and time the **e |
Graph reference: ediscoverySearchExportOperation
Property | Type | Description |
---|---|---|
action | microsoft.graph.security.caseAction | The type of action the operation represents. Possible values are: contentExport , applyTags , convertToPdf , index , estimateStatistics , addToReviewSet , holdUpdate , unknownFutureValue , purgeData , exportReport , exportResult . You must use the Prefer: include-unknown-enum-members request header to get the following values from this evolvable enum: purgeData , exportReport , exportResult . Inherited from microsoft.graph.security.caseOperation. |
additionalOptions | microsoft.graph.security.additionalOptions | The additional items to include in the export. The possible values are: none , teamsAndYammerConversations , cloudAttachments , allDocumentVersions , subfolderContents , listAttachments , unknownFutureValue . |
completedDateTime | DateTimeOffset | The date and time when the operation was completed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . Inherited from microsoft.graph.security.caseOperation. |
createdBy | microsoft.graph.identitySet | The user who created the operation. Inherited from microsoft.graph.security.caseOperation. |
createdDateTime | DateTimeOffset | The date and time when the operation was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. Inherited from microsoft.graph.security.caseOperation. |
description | String | The name of export provided by the user. |
displayName | String | The description of the export by the user. |
exportCriteria | microsoft.graph.security.exportCriteria | Items to be included in the export. The possible values are: searchHits , partiallyIndexed , unknownFutureValue . |
exportFileMetadata | microsoft.graph.security.ediscoveryExportFileMetadata collection | Contains the properties for an export file metadata, including downloadUrl, fileName, and size. |
exportFormat | microsoft.graph.security.exportFormat | Format of the emails of the export. The possible values are: pst , msg , eml , unknownFutureValue . |
exportLocation | microsoft.graph.security.exportLocation | Location scope for partially indexed items. You can choose to include partially indexed items only in responsive locations with search hits or in all targeted locations. The possible values are: responsiveLocations , nonresponsiveLocations , unknownFutureValue . |
exportSingleItems | Boolean | Indicates whether to export single items. |
id | String | The ID for the operation. Read-only. Inherited from microsoft.graph.security.caseOperation. |
percentProgress | Int32 | The progress of the operation. Inherited from microsoft.graph.security.caseOperation. |
resultInfo | microsoft.graph.resultInfo | Contains success and failure-specific result information. Inherited from microsoft.graph.security.caseOperation. |
status | microsoft.graph.security.caseOperationStatus | The status of the case operation. The possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed , unknownFutureValue . Inherited from microsoft.graph.security.caseOperation. |
Graph reference: siteSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the siteSource. |
createdDateTime | DateTimeOffset | The date and time the siteSource was created. |
displayName | String | The display name of the siteSource. This is the name of the SharePoint site. |
id | String | The ID of the siteSource. |
holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the **s |
Graph reference: unifiedGroupSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the unifiedGroupSource. |
createdDateTime | DateTimeOffset | The date and time the unifiedGroupSource was created. |
displayName | String | The display name of the unified group, which is the name of the group. |
holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the unifiedGroupSource. The possible values are: notApplied , applied , applying , removing , partial |
id | String | The ID of the unifiedGroupSource. This isn't the ID of the actual group. |
includedSources | microsoft.graph.security.sourceType | Specifies which sources are included in this group. Possible values are: mailbox , site . |
Graph reference: userSource
Property | Type | Description |
---|---|---|
createdBy | identitySet | The user who created the userSource. |
createdDateTime | DateTimeOffset | The date and time the userSource was created. |
displayName | String | The display name associated with the mailbox and site. |
String | Email address of the user's mailbox. | |
holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the userSource. The possible values are: notApplied , applied , applying , removing , partial . |
id | String | The ID of the userSource. This isn't the ID of the actual group. |
includedSources | microsoft.graph.security.sourceType | Specifies which sources are included in this group. Possible values are: mailbox , site . |
siteWebUrl | String | The URL of the user's OneDrive for Business site. Read-only. |