eDiscovery.Read.All

Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.

Graph Methods

Type: A = Application Permission, D = Delegate Permission

Ver	Type	Method
V1	D	DELETE /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources/{siteSourceId}
V1	D	DELETE /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources/{userSourceId}
V1	D	DELETE /compliance/ediscovery/cases/{caseId}/legalHolds/{legalHoldId}
V1	D	DELETE /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}
V1	D	DELETE /compliance/ediscovery/cases/{caseId}/tags/{tagId}?forcedelete=true
V1	D	DELETE /compliance/ediscovery/cases/{id}
V1	D	DELETE /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries/{id}
V1	D	DELETE /compliance/ediscovery/cases/4c8f8f70-7785-4bd4-b296-c98376a2c5e1/custodians/2192ca408ea2410eba3bec8ae873be6b/unifiedGroupSources/33434233-3030-3739-3043-393039324633
V1	D	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}
V1	D	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}
V1	D	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
V1	D	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{tagId}
V1	D	GET /compliance/ediscovery/cases
V1	D	GET /compliance/ediscovery/cases/{caesId}/custodians/{custodianId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources/{siteSourceId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/unifiedGroupSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/unifiedGroupSources/{unifiedGroupSourceId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources/{userSourceId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/legalHolds
V1	D	GET /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/siteSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/userSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/noncustodialDataSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/noncustodialDataSources/{noncustodialDataSourceId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/noncustodialDataSources/{noncustodialDataSourceId}/dataSource
V1	D	GET /compliance/ediscovery/cases/{caseId}/operations
V1	D	GET /compliance/ediscovery/cases/{caseId}/operations/{operationId}/microsoft.graph.ediscovery.caseExportOperation/getDownloadUrl
V1	D	GET /compliance/ediscovery/cases/{caseId}/reviewSets
V1	D	GET /compliance/ediscovery/cases/{caseId}/settings
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/additionalSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/addToReviewSetOperation
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/custodianSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/lastEstimateStatisticsOperation
V1	D	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/noncustodialSources
V1	D	GET /compliance/ediscovery/cases/{caseId}/tags
V1	D	GET /compliance/ediscovery/cases/{caseId}/tags/{tagId}
V1	D	GET /compliance/ediscovery/cases/{caseId}/tags/{tagId}/childTags
V1	D	GET /compliance/ediscovery/cases/{caseId}/tags/asHierarchy
V1	D	GET /compliance/ediscovery/cases/{id}
V1	D	GET /compliance/ediscovery/cases/{id}/reviewSets/{id}
V1	D	GET /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries
V1	D	GET /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries/{id}
V1	D	GET /ediscoveryExportOperation/reviewSet
V1	D	GET /security/cases/ediscoveryCases
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoverycustodianId}/lastIndexOperation
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialSources/{ediscoveryNoncustodialDataSourceId}/lastIndexOperation
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations/{eDiscoveryCaseOperationId}/microsoft.graph.security.ediscoveryExportOperation/getDownloadUrl
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/custodian
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/childTags/{ediscoveryReviewTagId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/parent
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/run
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/lastEstimateStatisticsOperation
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
V1	D	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/asHierarchy
V1	D	PATCH /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}
V1	D	PATCH /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}
V1	D	PATCH /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}
V1	D	PATCH /compliance/ediscovery/cases/{caseId}/tags/{tagId}
V1	D	PATCH /compliance/ediscovery/cases/{id}
V1	D	PATCH /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries/{id}
V1	D	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}
V1	D	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}
V1	D	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
V1	D	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
V1	D	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
V1	D	POST /compliance/ediscovery/cases
V1	D	POST /compliance/ediscovery/cases/{CaseId}/close
V1	D	POST /compliance/ediscovery/cases/{caseId}/custodians
V1	D	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/activate
V1	D	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/release
V1	D	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources
V1	D	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources
V1	D	POST /compliance/ediscovery/cases/{caseId}/legalHolds
V1	D	POST /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/siteSources
V1	D	POST /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/userSources
V1	D	POST /compliance/ediscovery/cases/{caseId}/noncustodialDataSources
V1	D	POST /compliance/ediscovery/cases/{caseId}/noncustodialDataSources/{noncustodialDataSourceId}/release
V1	D	POST /compliance/ediscovery/cases/{caseId}/reopen
V1	D	POST /compliance/ediscovery/cases/{caseId}/reviewSets/{reviewsetId}/addToReviewSet
V1	D	POST /compliance/ediscovery/cases/{caseId}/reviewsets/{reviewsetId}/export
V1	D	POST /compliance/ediscovery/cases/{caseId}/reviewSets/{reviewSetId}/queries/{reviewSetQueryId}/applyTags
V1	D	POST /compliance/ediscovery/cases/{caseId}/sourceCollections
V1	D	POST /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/additionalSources
V1	D	POST /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/custodianSources/$ref
V1	D	POST /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/estimateStatistics
V1	D	POST /compliance/ediscovery/cases/{caseId}/tags
V1	D	POST /compliance/ediscovery/cases/{id}/reviewSets
V1	D	POST /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries
V1	D	POST /compliance/ediscovery/cases/4c8f8f70-7785-4bd4-b296-c98376a2c5e1/custodians/2192ca408ea2410eba3bec8ae873be6b/unifiedGroupSources
V1	D	POST /security/cases/ediscoveryCases
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/close
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/activate
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/applyHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/release
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/removeHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/updateIndex
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/applyHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/removeHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/siteSources
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/applyHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/release
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/removeHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/updateIndex
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/applyHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/removeHold
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reopen
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
V1	D	POST /security/cases/ediscoveryCases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/export
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/applyTags
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/export
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/estimateStatistics
V1	D	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags

Delegate Permission


Id	99201db3-7652-4d5a-809a-bdb94f85fe3c
Consent Type	Admin
Display String	Read all eDiscovery objects
Description	Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.

Application Permission


Id	50180013-6191-4d1e-a373-e590ff4e66af
Display String	Read all eDiscovery objects
Description	Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.

Resources

addToReviewSetOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The case action for this entity will always be `addToReviewSet`. Read-only. Inherited from caseOperation.
completedDateTime	DateTimeOffset	The date and time the operation was completed. Read-only. Inherited from caseOperation
createdBy	identitySet	The user who created the operation. Read-only. Inherited from caseOperation
createdDateTime	DateTimeOffset	The date and time the operation was started. Read-only. Inherited from caseOperation
id	String	The ID for the operation. Read-only. Inherited from caseOperation.
percentProgress	Int32	The progress of the operation. Read-only. Inherited from caseOperation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Inherited from caseOperation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

case

Property	Type	Description
closedBy	identitySet	The user who closed the case.
closedDateTime	DateTimeOffset	The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
createdBy	identitySet	The user who created the case.
createdDateTime	DateTimeOffset	The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
description	String	The case description.
displayName	String	The case name.
externalId	String	The external case number for customer reference.
id	String	The ID for the eDiscovery case. Read-only.
lastModifiedBy	identitySet	The last user who modified the entity.
lastModifiedDateTime	DateTimeOffset	The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
status	microsoft.graph.ediscovery.caseStatus	The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.

caseExportOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The case action for this entity will always be `contentExport`. Inherited from caseOperation.
azureBlobContainer	String	The name of the Azure storage location where the export will be stored. This only applies to exports stored in your own Azure storage location.
azureBlobToken	String	The SAS token for the Azure storage location. This only applies to exports stored in your own Azure storage location.
completedDateTime	DateTimeOffset	The date and time the export was completed. Inherited from caseOperation.
createdBy	identitySet	The user who initiated the export operation. Inherited from caseOperation.
createdDateTime	DateTimeOffset	The date and time the export was created. Inherited from caseOperation.
description	String	The description provided for the export.
exportOptions	microsoft.graph.ediscovery.exportOptions	The options provided for the export. For more details, see reviewSet: export. Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.
exportStructure	microsoft.graph.ediscovery.exportFileStructure	The options provided that specify the structure of the export. For more details, see reviewSet: export. Possible values are: `none`, `directory`, `pst`.
id	String	The ID for the operation. Read-only. Inherited from caseOperation.
outputName	String	The name provided for the export.
percentProgress	Int32	The progress of the operation. Inherited from caseOperation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Inherited from caseOperation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

caseOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

custodian

Property	Type	Description
acknowledgedDateTime	DateTimeOffset	Date and time the custodian acknowledged a hold notification.
applyHoldToSources	Boolean	Identifies whether a custodian's sources were placed on hold during creation.
createdDateTime	DateTimeOffset	Date and time when the custodian was added to the case.
displayName	String	Display name of the custodian.
email	String	Email address of the custodian.
id	String	The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime	DateTimeOffset	Date and time the custodian object was last modified
releasedDateTime	DateTimeOffset	Date and time the custodian was released from the case.
status	microsoft.graph.ediscovery.custodianStatus	Status of the custodian. Possible values are: `active`, `released`.

dataSource

Property	Type	Description
createdBy	identitySet	The user who created the dataSource.
createdDateTime	DateTimeOffset	The date and time the dataSource was created.
displayName	String	The display name of the dataSource. This will be the name of the SharePoint site.
id	String	The ID of the **d

estimateStatisticsOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The type of operation. The case action for this entity will always be `estimateStatistics`. Read-only. Inherited from caseOperation.
completedDateTime	DateTimeOffset	The date and time the operation was completed. Read-only. Inherited from caseOperation.
createdBy	identitySet	The user who created the operation. Read-only. Inherited from caseOperation.
createdDateTime	DateTimeOffset	The date and time the operation was started. Read-only. Inherited from caseOperation.
id	String	The ID for the operation. Read-only. Inherited from caseOperation.
indexedItemCount	Int64	The estimated count of items for the sourceCollection that matched the content query.
indexedItemsSize	Int64	The estimated size of items for the sourceCollection that matched the content query.
mailboxCount	Int32	The number of mailboxes that had search hits.
percentProgress	Int32	The progress of the operation. Read-only. Inherited from caseOperation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
siteCount	Int32	The number of mailboxes that had search hits.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Inherited from caseOperation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.
unindexedItemCount	Int64	The estimated count of unindexed items for the collection.
unindexedItemsSize	Int64	The estimated size of unindexed items for the collection.

legalHold

Property	Type	Description
contentQuery	String	KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank.
createdBy	identitySet	The user who created the legal hold.
createdDateTime	DateTimeOffset	The date and time the legal hold was created.
description	String	The legal hold description.
displayName	String	The display name of the legal hold.
errors	String collection	Lists any errors that happened while placing the hold.
id	String	The ID for the eDiscovery case. Read-only. Inherited from entity.
isEnabled	Boolean	Indicates whether the hold is enabled and actively holding content.
lastModifiedBy	identitySet	the user who last modified the legal hold.
lastModifiedDateTime	DateTimeOffset	The date and time the legal hold was last modified.
status	microsoft.graph.ediscovery.legalHoldStatus	The status of the legal hold. Possible values are: `Pending`, `Error`, `Success`, `UnknownFutureValue`.

noncustodialDataSource

Property	Type	Description
applyHoldToSource	Boolean	Indicates if hold is applied to non-custodial data source (such as mailbox or site).
createdDateTime	DateTimeOffset	Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
displayName	String	Display name of the noncustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
id	String	Unique identifier of the nonCustodialDataSource. Inherited from entity.
lastModifiedDateTime	DateTimeOffset	Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
releasedDateTime	DateTimeOffset	Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
status	microsoft.graph.ediscovery.dataSourceContainerStatus	Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. Possible values are: `Active`, `Released`.

reviewSet

Property	Type	Description
createdBy	identitySet	The user who created the review set. Read-only.
createdDateTime	DateTimeOffset	The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
displayName	String	The review set name. The name is unique with a maximum limit of 64 characters.
id	String	The review set unique identifier. Read-only.

reviewSetQuery

Property	Type	Description
createdBy	identitySet	The user who created the query.
createdDateTime	DateTimeOffset	The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
displayName	String	The name of the query.
id	String	The unique identifier of the query. Read-only.
lastModifiedBy	identitySet	The user who last modified the query.
lastModifiedDateTime	DateTimeOffset	The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
query	String	The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in Advanced eDiscovery. This field maps directly to the keywords condition. You can refine searches by using fields listed in the *s

siteSource

Property	Type	Description
createdBy	identitySet	The user who created the siteSource.
createdDateTime	DateTimeOffset	The date and time the siteSource was created.
displayName	String	The display name of the siteSource. This will be the name of the SharePoint site.
id	String	The ID of the **s

sourceCollection

Property	Type	Description
contentQuery	String	The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy	identitySet	The user who created the sourceCollection.
createdDateTime	DateTimeOffset	The date and time the sourceCollection was created.
dataSourceScopes	microsoft.graph.ediscovery.dataSourceScopes	When specified, the collection will span across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.
description	String	The description of the sourceCollection.
displayName	String	The display name of the sourceCollection.
id	String	The ID for the sourceCollection. Read-only.
lastModifiedBy	identitySet	The last user who modified the sourceCollection.
lastModifiedDateTime	DateTimeOffset	The last date and time the **s

tag

Property	Type	Description
childSelectability	microsoft.graph.ediscovery.childSelectability	Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.
createdBy	identitySet	The user who created the tag.
description	String	The description for the tag.
displayName	String	Display name of the tag.
id	String	Unique identifier for the tag.
lastModifiedDateTime	DateTimeOffset	The date and time the tag was last modified.

unifiedGroupSource

Property	Type	Description
createdBy	identitySet	The user who created the unifiedGroupSource.
createdDateTime	DateTimeOffset	The date and time the unifiedGroupSource was created.
displayName	String	The display name of the unified group - This is the name of the group.
id	String	The ID of the unifiedGroupSource. This is not the ID of the actual group.
includedSources	microsoft.graph.ediscovery.sourceType	Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.

userSource

Property	Type	Description
createdBy	identitySet	The user who created the userSource.
createdDateTime	DateTimeOffset	The date and time the userSource was created
displayName	String	The display name associated with the mailbox and site.
email	String	Email address of the user's mailbox.
id	String	The ID of the userSource. This is not the ID of the actual group
includedSources	microsoft.graph.ediscovery.sourceType	Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.
siteWebUrl	String	The URL of the user's OneDrive for Business site. Read-only.

caseOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

dataSource

Property	Type	Description
createdBy	identitySet	The user who created the dataSource.
createdDateTime	DateTimeOffset	The date and time the dataSource was created.
displayName	String	The display name of the dataSource. This will be the name of the SharePoint site.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the dataSource.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	The ID of the **d

ediscoveryAddToReviewSetOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

ediscoveryCase

Property	Type	Description
closedBy	microsoft.graph.identitySet	The user who closed the case.
closedDateTime	DateTimeOffset	The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
createdBy	microsoft.graph.identitySet	The user who created the case.
createdDateTime	DateTimeOffset	The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
description	String	The case description.
displayName	String	The case name.
externalId	String	The external case number for customer reference.
id	String	The ID for the eDiscovery case. Read-only.
lastModifiedBy	microsoft.graph.identitySet	The last user who modified the case.
lastModifiedDateTime	DateTimeOffset	The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
status	microsoft.graph.security.caseStatus	The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.

ediscoveryCaseSettings

Property	Type	Description
id	String	The ID of the eDiscovery case. Inherited from entity.
ocr	microsoft.graph.security.ocrSettings	The OCR (Optical Character Recognition) settings for the case.
redundancyDetection	microsoft.graph.security.redundancyDetectionSettings	The redundancy (near duplicate and email threading) detection settings for the case.
topicModeling	microsoft.graph.security.topicModelingSettings	The Topic Modeling (Themes) settings for the case.

ediscoveryCustodian

Property	Type	Description
acknowledgedDateTime	DateTimeOffset	Date and time the custodian acknowledged a hold notification.
createdDateTime	DateTimeOffset	Date and time when the custodian was added to the case.
displayName	String	Display name of the custodian.
email	String	Email address of the custodian.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the custodian.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime	DateTimeOffset	Date and time the custodian object was last modified
releasedDateTime	DateTimeOffset	Date and time the custodian was released from the case.
status	microsoft.graph.security.custodianStatus	Status of the custodian. Possible values are: `active`, `released`.

ediscoveryEstimateOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed. Read-only.
createdBy	identitySet	The user who created the operation. Read-only.
createdDateTime	DateTimeOffset	The date and time the operation was started. Read-only.
id	String	The ID for the operation. Read-only.
indexedItemCount	Int64	The estimated count of items for the search that matched the content query.
indexedItemsSize	Int64	The estimated size of items for the search that matched the content query.
mailboxCount	Int32	The number of mailboxes that had search hits.
percentProgress	Int32	The progress of the operation. Read-only.
resultInfo	resultInfo	Contains success and failure-specific result information.
siteCount	Int32	The number of mailboxes that had search hits.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.
unindexedItemCount	Int64	The estimated count of unindexed items for the collection.
unindexedItemsSize	Int64	The estimated size of unindexed items for the collection.

ediscoveryExportOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
azureBlobContainer	String	The name of the Azure storage location where the export will be stored. This only applies to exports stored in your own Azure storage location.
azureBlobToken	String	The SAS token for the Azure storage location. This only applies to exports stored in your own Azure storage location.
completedDateTime	DateTimeOffset	The date and time the export was completed.
createdBy	identitySet	The user who initiated the export operation.
createdDateTime	DateTimeOffset	The date and time the export was created.
description	String	The description provided for the export.
exportOptions	microsoft.graph.security.exportOptions	The options provided for the export. For more details, see reviewSet: export. Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.
exportStructure	microsoft.graph.security.exportFileStructure	The options provided that specify the structure of the export. For more details, see reviewSet: export. Possible values are: `none`, `directory`, `pst`.
id	String	The ID for the operation. Read-only.
outputName	String	The name provided for the export.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

ediscoveryFile

Property	Type	Description
content	Stream	The content stream of the original file.
dateTime	DateTimeOffset	The datetime the file was last modified. See dateTime values for more details.
extension	String	The file extension of the file such as png, msg, docx etc.
extractedTextContent	Stream	The extracted text from the original file. For image based files, this would be the OCR text.
id	String	The unique identifier for the file.
mediaType	String	mimeType of the file. Eg: text/plain, charset=UTF-8, application/vnd.ms-outlook.
name	String	The name of the file. Subject of the mail in case of email.
otherProperties	microsoft.graph.security.stringValueDictionary	A list of additional properties of the file like titleOfSharepointDocument, emailRecipients. Learn more.
processingStatus	microsoft.graph.security.fileProcessingStatus	The processing status after the item was added to a review set. The possible values are: `success`, `internalError`, `unknownError`, `processingTimeout`, `invalidFileId`, `fileSizeIsZero`, `fileSizeIsTooLarge`, `fileDepthLimitExceeded`, `fileBodyIsTooLong`, `fileTypeIsUnknown`, `fileTypeIsNotSupported`, `malformedFile`, `protectedFile`, `poisonFile`, `noReviewSetSummaryGenerated`, `extractionException`, `ocrProcessingTimeout`, `ocrFileSizeExceedsLimit`.
senderAuthor	String collection	The sender of the email or authors of the document.
size	Int64	size of the file.
sourceType	microsoft.graph.security.sourceType	The original source of the content. The possible values are: `mailbox`, `site`.
subjectTitle	String	The subject of the email or title of the document

ediscoveryHoldOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

ediscoveryHoldPolicy

Property	Type	Description
contentQuery	String	KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank.
createdBy	identitySet	The user who created the legal hold.
createdDateTime	DateTimeOffset	The date and time the legal hold was created.
description	String	The legal hold description.
displayName	String	The display name of the legal hold.
errors	String collection	Lists any errors that happened while placing the hold.
id	String	The ID for the eDiscovery case. Read-only. Inherited from entity.
isEnabled	Boolean	Indicates whether the hold is enabled and actively holding content.
lastModifiedBy	identitySet	the user who last modified the legal hold.
lastModifiedDateTime	DateTimeOffset	The date and time the legal hold was last modified.
status	microsoft.graph.security.policyStatus	The status of the legal hold. Possible values are: `Pending`, `Error`, `Success`.

ediscoveryIndexOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

ediscoveryNoncustodialDataSource

Property	Type	Description
createdDateTime	DateTimeOffset	Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer.
displayName	String	Display name of the noncustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the nonCustodialDataSource.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	Unique identifier of the nonCustodialDataSource. Inherited from entity.
lastModifiedDateTime	DateTimeOffset	Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer.
releasedDateTime	DateTimeOffset	Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.security.datasourcecontainer.
status	microsoft.graph.security.dataSourceContainerStatus	Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. Possible values are: `Active`, `Released`.

ediscoveryReviewSet

Property	Type	Description
createdBy	microsoft.graph.identitySet	The user who created the review set. Read-only.
createdDateTime	DateTimeOffset	The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
displayName	String	The review set name. The name is unique with a maximum limit of 64 characters.
id	String	The review set unique identifier. Read-only.

ediscoveryReviewSetQuery

Property	Type	Description
createdBy	identitySet	The user who created the query.
createdDateTime	DateTimeOffset	The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
displayName	String	The name of the query.
id	String	The unique identifier of the query. Read-only.
lastModifiedBy	identitySet	The user who last modified the query.
lastModifiedDateTime	DateTimeOffset	The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
query	String	The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in eDiscovery (Premium). This field maps directly to the keywords condition. You can refine searches by using fields listed in the *s

ediscoveryReviewTag

Property	Type	Description
childSelectability	microsoft.graph.security.childSelectability	Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.
createdBy	identitySet	The user who created the tag.
description	String	The description for the tag.
displayName	String	Display name of the tag.
id	String	Unique identifier for the tag.
lastModifiedDateTime	DateTimeOffset	The date and time the tag was last modified.

ediscoverySearch

Property	Type	Description
contentQuery	String	The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy	identitySet	The user who created the eDiscovery search.
createdDateTime	DateTimeOffset	The date and time the eDiscovery search was created.
dataSourceScopes	microsoft.graph.security.dataSourceScopes	When specified, the collection will span across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.
description	String	The description of the eDiscovery search.
displayName	String	The display name of the eDiscovery search.
id	String	The ID for the eDiscovery search. Read-only.
lastModifiedBy	identitySet	The last user who modified the eDiscovery search.
lastModifiedDateTime	DateTimeOffset	The last date and time the **e

siteSource

Property	Type	Description
createdBy	identitySet	The user who created the siteSource.
createdDateTime	DateTimeOffset	The date and time the siteSource was created.
displayName	String	The display name of the siteSource. This will be the name of the SharePoint site.
id	String	The ID of the siteSource.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the **s

unifiedGroupSource

Property	Type	Description
createdBy	identitySet	The user who created the unifiedGroupSource.
createdDateTime	DateTimeOffset	The date and time the unifiedGroupSource was created.
displayName	String	The display name of the unified group, which is the name of the group.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the unifiedGroupSource. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	The ID of the unifiedGroupSource. This is not the ID of the actual group.
includedSources	microsoft.graph.security.sourceType	Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.

userSource

Property	Type	Description
createdBy	identitySet	The user who created the userSource.
createdDateTime	DateTimeOffset	The date and time the userSource was created.
displayName	String	The display name associated with the mailbox and site.
email	String	Email address of the user's mailbox.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the userSource. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`.
id	String	The ID of the userSource. This is not the ID of the actual group.
includedSources	microsoft.graph.security.sourceType	Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.
siteWebUrl	String	The URL of the user's OneDrive for Business site. Read-only.