eDiscovery.Read.All

Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the eDiscovery.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	50180013-6191-4d1e-a373-e590ff4e66af	99201db3-7652-4d5a-809a-bdb94f85fe3c
DisplayText	Read all eDiscovery objects	Read all eDiscovery objects
Description	Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.	Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{tagId}
	GET /security/cases/ediscoveryCases
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoverycustodianId}/lastIndexOperation
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialSources/{ediscoveryNoncustodialDataSourceId}/lastIndexOperation
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/custodian
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/childTags/{ediscoveryReviewTagId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/parent
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{reviewSetId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/lastEstimateStatisticsOperation
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/asHierarchy
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
	POST /security/cases/ediscoveryCases
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/close
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/activate
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/release
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/updateIndex
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/release
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/updateIndex
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reopen
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
	POST /security/cases/ediscoveryCases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/export
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/applyTags
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/export
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/estimateStatistics
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources/{siteSourceId}
	DELETE /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources/{userSourceId}
	DELETE /compliance/ediscovery/cases/{caseId}/legalHolds/{legalHoldId}
	DELETE /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}
	DELETE /compliance/ediscovery/cases/{caseId}/tags/{tagId}?forcedelete=true
	DELETE /compliance/ediscovery/cases/{id}
	DELETE /compliance/ediscovery/cases/{id}/custodians/{id}/unifiedGroupSources/{id}
	DELETE /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries/{id}
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
	DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{tagId}
	GET /compliance/ediscovery/cases
	GET /compliance/ediscovery/cases/{caesId}/custodians/{custodianId}
	GET /compliance/ediscovery/cases/{caseId}/custodians
	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources
	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources/{siteSourceId}
	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/unifiedGroupSources
	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/unifiedGroupSources/{unifiedGroupSourceId}
	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources
	GET /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources/{userSourceId}
	GET /compliance/ediscovery/cases/{caseId}/legalHolds
	GET /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}
	GET /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/siteSources
	GET /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/userSources
	GET /compliance/ediscovery/cases/{caseId}/noncustodialDataSources
	GET /compliance/ediscovery/cases/{caseId}/noncustodialDataSources/{noncustodialDataSourceId}
	GET /compliance/ediscovery/cases/{caseId}/noncustodialDataSources/{noncustodialDataSourceId}/dataSource
	GET /compliance/ediscovery/cases/{caseId}/operations
	GET /compliance/ediscovery/cases/{caseId}/operations/{operationId}/microsoft.graph.ediscovery.caseExportOperation/getDownloadUrl
	GET /compliance/ediscovery/cases/{caseId}/reviewSets
	GET /compliance/ediscovery/cases/{caseId}/settings
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/additionalSources
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/addToReviewSetOperation
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/custodianSources
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/lastEstimateStatisticsOperation
	GET /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/noncustodialSources
	GET /compliance/ediscovery/cases/{caseId}/tags
	GET /compliance/ediscovery/cases/{caseId}/tags/{tagId}
	GET /compliance/ediscovery/cases/{caseId}/tags/{tagId}/childTags
	GET /compliance/ediscovery/cases/{caseId}/tags/asHierarchy
	GET /compliance/ediscovery/cases/{id}
	GET /compliance/ediscovery/cases/{id}/reviewSets/{id}
	GET /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries
	GET /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries/{id}
	GET /security/cases/ediscoveryCases
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoverycustodianId}/lastIndexOperation
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialSources/{ediscoveryNoncustodialDataSourceId}/lastIndexOperation
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations/{eDiscoveryCaseOperationId}/microsoft.graph.security.ediscoveryExportOperation/getDownloadUrl
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/custodian
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/childTags/{ediscoveryReviewTagId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/parent
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/run
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{reviewSetId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/lastEstimateStatisticsOperation
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
	GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/asHierarchy
	PATCH /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}
	PATCH /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}
	PATCH /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}
	PATCH /compliance/ediscovery/cases/{caseId}/tags/{tagId}
	PATCH /compliance/ediscovery/cases/{id}
	PATCH /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries/{id}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
	PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
	POST /compliance/ediscovery/cases
	POST /compliance/ediscovery/cases/{CaseId}/close
	POST /compliance/ediscovery/cases/{caseId}/custodians
	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/activate
	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/release
	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/siteSources
	POST /compliance/ediscovery/cases/{caseId}/custodians/{custodianId}/userSources
	POST /compliance/ediscovery/cases/{caseId}/legalHolds
	POST /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/siteSources
	POST /compliance/ediscovery/cases/{caseId}/legalHolds/{legalholdId}/userSources
	POST /compliance/ediscovery/cases/{caseId}/noncustodialDataSources
	POST /compliance/ediscovery/cases/{caseId}/noncustodialDataSources/{noncustodialDataSourceId}/release
	POST /compliance/ediscovery/cases/{caseId}/reopen
	POST /compliance/ediscovery/cases/{caseId}/reviewSets/{reviewsetId}/addToReviewSet
	POST /compliance/ediscovery/cases/{caseId}/reviewsets/{reviewsetId}/export
	POST /compliance/ediscovery/cases/{caseId}/reviewSets/{reviewSetId}/queries/{reviewSetQueryId}/applyTags
	POST /compliance/ediscovery/cases/{caseId}/sourceCollections
	POST /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/additionalSources
	POST /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/custodianSources/$ref
	POST /compliance/ediscovery/cases/{caseId}/sourceCollections/{sourceCollectionId}/estimateStatistics
	POST /compliance/ediscovery/cases/{caseId}/tags
	POST /compliance/ediscovery/cases/{id}/custodians/{id}/unifiedGroupSources
	POST /compliance/ediscovery/cases/{id}/reviewSets
	POST /compliance/ediscovery/cases/{id}/reviewSets/{id}/queries
	POST /security/cases/ediscoveryCases
	POST /security/cases/ediscoveryCases('{ediscoveryCaseId}')/searches('{ediscoverySearchId}')/exportReport
	POST /security/cases/ediscoveryCases('{ediscoveryCaseId}')/searches('{ediscoverySearchId}')/exportResult
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/close
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/activate
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/release
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/updateIndex
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/updateIndex
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/siteSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/release
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/updateIndex
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/applyHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/removeHold
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reopen
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
	POST /security/cases/ediscoveryCases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/export
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/applyTags
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/export
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/estimateStatistics
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/exportReport
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/exportResult
	POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Add-MgSecurityCaseEdiscoveryCaseCustodianHold
	Add-MgSecurityCaseEdiscoveryCaseNoncustodialDataSourceHold
	Add-MgSecurityCaseEdiscoveryCaseReviewSetQueryTag
	Add-MgSecurityCaseEdiscoveryCaseReviewSetToReviewSet
	Close-MgSecurityCaseEdiscoveryCase
	Export-MgSecurityCaseEdiscoveryCaseReviewSet
	Export-MgSecurityCaseEdiscoveryCaseReviewSetQuery
	Get-MgSecurityCaseEdiscoveryCase
	Get-MgSecurityCaseEdiscoveryCaseCustodian
	Get-MgSecurityCaseEdiscoveryCaseCustodianLastIndexOperation
	Get-MgSecurityCaseEdiscoveryCaseCustodianSiteSource
	Get-MgSecurityCaseEdiscoveryCaseCustodianUnifiedGroupSource
	Get-MgSecurityCaseEdiscoveryCaseCustodianUserSource
	Get-MgSecurityCaseEdiscoveryCaseNoncustodialDataSource
	Get-MgSecurityCaseEdiscoveryCaseOperation
	Get-MgSecurityCaseEdiscoveryCaseReviewSet
	Get-MgSecurityCaseEdiscoveryCaseReviewSetQuery
	Get-MgSecurityCaseEdiscoveryCaseSearch
	Get-MgSecurityCaseEdiscoveryCaseSearchLastEstimateStatisticsOperation
	Get-MgSecurityCaseEdiscoveryCaseSetting
	Get-MgSecurityCaseEdiscoveryCaseTag
	Initialize-MgSecurityCaseEdiscoveryCaseCustodian
	Invoke-MgAsSecurityCaseEdiscoveryCaseTagHierarchy
	Invoke-MgEstimateSecurityCaseEdiscoveryCaseSearchStatistics
	Invoke-MgReopenSecurityCaseEdiscoveryCase
	New-MgSecurityCaseEdiscoveryCase
	New-MgSecurityCaseEdiscoveryCaseCustodian
	New-MgSecurityCaseEdiscoveryCaseCustodianSiteSource
	New-MgSecurityCaseEdiscoveryCaseCustodianUnifiedGroupSource
	New-MgSecurityCaseEdiscoveryCaseCustodianUserSource
	New-MgSecurityCaseEdiscoveryCaseNoncustodialDataSource
	New-MgSecurityCaseEdiscoveryCaseReviewSet
	New-MgSecurityCaseEdiscoveryCaseReviewSetQuery
	New-MgSecurityCaseEdiscoveryCaseSearch
	New-MgSecurityCaseEdiscoveryCaseTag
	Publish-MgSecurityCaseEdiscoveryCaseCustodian
	Publish-MgSecurityCaseEdiscoveryCaseNoncustodialDataSource
	Remove-MgSecurityCaseEdiscoveryCase
	Remove-MgSecurityCaseEdiscoveryCaseCustodianHold
	Remove-MgSecurityCaseEdiscoveryCaseNoncustodialDataSourceHold
	Remove-MgSecurityCaseEdiscoveryCaseSearch
	Remove-MgSecurityCaseEdiscoveryCaseTag
	Update-MgSecurityCaseEdiscoveryCase
	Update-MgSecurityCaseEdiscoveryCaseCustodianIndex
	Update-MgSecurityCaseEdiscoveryCaseNoncustodialDataSourceIndex
	Update-MgSecurityCaseEdiscoveryCaseReviewSetQuery
	Update-MgSecurityCaseEdiscoveryCaseSearch
	Update-MgSecurityCaseEdiscoveryCaseTag

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Add-MgBetaComplianceEdiscoveryCaseReviewSetQueryTag
	Add-MgBetaComplianceEdiscoveryCaseReviewSetToReviewSet
	Add-MgBetaSecurityCaseEdiscoveryCaseCustodianHold
	Add-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSourceHold
	Add-MgBetaSecurityCaseEdiscoveryCaseReviewSetQueryTag
	Add-MgBetaSecurityCaseEdiscoveryCaseReviewSetToReviewSet
	Close-MgBetaComplianceEdiscoveryCase
	Close-MgBetaSecurityCaseEdiscoveryCase
	Export-MgBetaComplianceEdiscoveryCaseReviewSet
	Export-MgBetaSecurityCaseEdiscoveryCaseReviewSet
	Export-MgBetaSecurityCaseEdiscoveryCaseReviewSetQuery
	Export-MgBetaSecurityCaseEdiscoveryCaseSearchReport
	Export-MgBetaSecurityCaseEdiscoveryCaseSearchResult
	Get-MgBetaComplianceEdiscoveryCase
	Get-MgBetaComplianceEdiscoveryCaseCustodian
	Get-MgBetaComplianceEdiscoveryCaseCustodianSiteSource
	Get-MgBetaComplianceEdiscoveryCaseCustodianUnifiedGroupSource
	Get-MgBetaComplianceEdiscoveryCaseCustodianUserSource
	Get-MgBetaComplianceEdiscoveryCaseLegalHold
	Get-MgBetaComplianceEdiscoveryCaseLegalHoldSiteSource
	Get-MgBetaComplianceEdiscoveryCaseLegalHoldUserSource
	Get-MgBetaComplianceEdiscoveryCaseNoncustodialDataSource
	Get-MgBetaComplianceEdiscoveryCaseNoncustodialDataSourceDataSource
	Get-MgBetaComplianceEdiscoveryCaseOperation
	Get-MgBetaComplianceEdiscoveryCaseReviewSet
	Get-MgBetaComplianceEdiscoveryCaseReviewSetQuery
	Get-MgBetaComplianceEdiscoveryCaseSetting
	Get-MgBetaComplianceEdiscoveryCaseSourceCollection
	Get-MgBetaComplianceEdiscoveryCaseSourceCollectionAdditionalSource
	Get-MgBetaComplianceEdiscoveryCaseSourceCollectionAddToReviewSetOperation
	Get-MgBetaComplianceEdiscoveryCaseSourceCollectionCustodianSource
	Get-MgBetaComplianceEdiscoveryCaseSourceCollectionLastEstimateStatisticsOperation
	Get-MgBetaComplianceEdiscoveryCaseSourceCollectionNoncustodialSource
	Get-MgBetaComplianceEdiscoveryCaseTag
	Get-MgBetaComplianceEdiscoveryCaseTagChildTag
	Get-MgBetaSecurityCaseEdiscoveryCase
	Get-MgBetaSecurityCaseEdiscoveryCaseCustodian
	Get-MgBetaSecurityCaseEdiscoveryCaseCustodianLastIndexOperation
	Get-MgBetaSecurityCaseEdiscoveryCaseCustodianSiteSource
	Get-MgBetaSecurityCaseEdiscoveryCaseCustodianUnifiedGroupSource
	Get-MgBetaSecurityCaseEdiscoveryCaseCustodianUserSource
	Get-MgBetaSecurityCaseEdiscoveryCaseLegalHold
	Get-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSource
	Get-MgBetaSecurityCaseEdiscoveryCaseOperation
	Get-MgBetaSecurityCaseEdiscoveryCaseReviewSet
	Get-MgBetaSecurityCaseEdiscoveryCaseReviewSetFile
	Get-MgBetaSecurityCaseEdiscoveryCaseReviewSetQuery
	Get-MgBetaSecurityCaseEdiscoveryCaseSearch
	Get-MgBetaSecurityCaseEdiscoveryCaseSearchLastEstimateStatisticsOperation
	Get-MgBetaSecurityCaseEdiscoveryCaseSetting
	Get-MgBetaSecurityCaseEdiscoveryCaseTag
	Initialize-MgBetaComplianceEdiscoveryCaseCustodian
	Initialize-MgBetaSecurityCaseEdiscoveryCaseCustodian
	Invoke-MgBetaAsComplianceEdiscoveryCaseTagHierarchy
	Invoke-MgBetaAsSecurityCaseEdiscoveryCaseTagHierarchy
	Invoke-MgBetaEstimateComplianceEdiscoveryCaseSourceCollectionStatistics
	Invoke-MgBetaEstimateSecurityCaseEdiscoveryCaseSearchStatistics
	Invoke-MgBetaReopenComplianceEdiscoveryCase
	Invoke-MgBetaReopenSecurityCaseEdiscoveryCase
	New-MgBetaComplianceEdiscoveryCase
	New-MgBetaComplianceEdiscoveryCaseCustodian
	New-MgBetaComplianceEdiscoveryCaseCustodianSiteSource
	New-MgBetaComplianceEdiscoveryCaseCustodianUnifiedGroupSource
	New-MgBetaComplianceEdiscoveryCaseCustodianUserSource
	New-MgBetaComplianceEdiscoveryCaseLegalHold
	New-MgBetaComplianceEdiscoveryCaseLegalHoldSiteSource
	New-MgBetaComplianceEdiscoveryCaseLegalHoldUserSource
	New-MgBetaComplianceEdiscoveryCaseNoncustodialDataSource
	New-MgBetaComplianceEdiscoveryCaseReviewSet
	New-MgBetaComplianceEdiscoveryCaseReviewSetQuery
	New-MgBetaComplianceEdiscoveryCaseSourceCollection
	New-MgBetaComplianceEdiscoveryCaseSourceCollectionAdditionalSource
	New-MgBetaComplianceEdiscoveryCaseTag
	New-MgBetaSecurityCaseEdiscoveryCase
	New-MgBetaSecurityCaseEdiscoveryCaseCustodian
	New-MgBetaSecurityCaseEdiscoveryCaseCustodianSiteSource
	New-MgBetaSecurityCaseEdiscoveryCaseCustodianUnifiedGroupSource
	New-MgBetaSecurityCaseEdiscoveryCaseCustodianUserSource
	New-MgBetaSecurityCaseEdiscoveryCaseLegalHold
	New-MgBetaSecurityCaseEdiscoveryCaseLegalHoldSiteSource
	New-MgBetaSecurityCaseEdiscoveryCaseLegalHoldUserSource
	New-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSource
	New-MgBetaSecurityCaseEdiscoveryCaseReviewSet
	New-MgBetaSecurityCaseEdiscoveryCaseReviewSetQuery
	New-MgBetaSecurityCaseEdiscoveryCaseSearch
	New-MgBetaSecurityCaseEdiscoveryCaseTag
	Publish-MgBetaComplianceEdiscoveryCaseCustodian
	Publish-MgBetaComplianceEdiscoveryCaseNoncustodialDataSource
	Publish-MgBetaSecurityCaseEdiscoveryCaseCustodian
	Publish-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSource
	Remove-MgBetaComplianceEdiscoveryCase
	Remove-MgBetaComplianceEdiscoveryCaseCustodianSiteSource
	Remove-MgBetaComplianceEdiscoveryCaseCustodianUnifiedGroupSource
	Remove-MgBetaComplianceEdiscoveryCaseCustodianUserSource
	Remove-MgBetaComplianceEdiscoveryCaseLegalHold
	Remove-MgBetaComplianceEdiscoveryCaseReviewSetQuery
	Remove-MgBetaComplianceEdiscoveryCaseSourceCollection
	Remove-MgBetaComplianceEdiscoveryCaseTag
	Remove-MgBetaSecurityCaseEdiscoveryCase
	Remove-MgBetaSecurityCaseEdiscoveryCaseCustodianHold
	Remove-MgBetaSecurityCaseEdiscoveryCaseLegalHold
	Remove-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSourceHold
	Remove-MgBetaSecurityCaseEdiscoveryCaseSearch
	Remove-MgBetaSecurityCaseEdiscoveryCaseTag
	Start-MgBetaSecurityCaseEdiscoveryCaseReviewSetQuery
	Update-MgBetaComplianceEdiscoveryCase
	Update-MgBetaComplianceEdiscoveryCaseCustodian
	Update-MgBetaComplianceEdiscoveryCaseLegalHold
	Update-MgBetaComplianceEdiscoveryCaseReviewSetQuery
	Update-MgBetaComplianceEdiscoveryCaseSourceCollection
	Update-MgBetaComplianceEdiscoveryCaseTag
	Update-MgBetaSecurityCaseEdiscoveryCase
	Update-MgBetaSecurityCaseEdiscoveryCaseCustodianIndex
	Update-MgBetaSecurityCaseEdiscoveryCaseLegalHold
	Update-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSourceIndex
	Update-MgBetaSecurityCaseEdiscoveryCaseReviewSetQuery
	Update-MgBetaSecurityCaseEdiscoveryCaseSearch
	Update-MgBetaSecurityCaseEdiscoveryCaseTag

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: addToReviewSetOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The case action for this entity will always be `addToReviewSet`. Read-only. Inherited from caseOperation.
completedDateTime	DateTimeOffset	The date and time the operation was completed. Read-only. Inherited from caseOperation
createdBy	identitySet	The user who created the operation. Read-only. Inherited from caseOperation
createdDateTime	DateTimeOffset	The date and time the operation was started. Read-only. Inherited from caseOperation
id	String	The ID for the operation. Read-only. Inherited from caseOperation.
percentProgress	Int32	The progress of the operation. Read-only. Inherited from caseOperation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Inherited from caseOperation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: case

Property	Type	Description
closedBy	identitySet	The user who closed the case.
closedDateTime	DateTimeOffset	The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
createdBy	identitySet	The user who created the case.
createdDateTime	DateTimeOffset	The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
description	String	The case description.
displayName	String	The case name.
externalId	String	The external case number for customer reference.
id	String	The ID for the eDiscovery case. Read-only.
lastModifiedBy	identitySet	The last user who modified the entity.
lastModifiedDateTime	DateTimeOffset	The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
status	microsoft.graph.ediscovery.caseStatus	The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.

Graph reference: caseExportOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The case action for this entity will always be `contentExport`. Inherited from caseOperation.
azureBlobContainer	String	The name of the Azure storage location where the export will be stored. This only applies to exports stored in your own Azure storage location.
azureBlobToken	String	The SAS token for the Azure storage location. This only applies to exports stored in your own Azure storage location.
completedDateTime	DateTimeOffset	The date and time the export was completed. Inherited from caseOperation.
createdBy	identitySet	The user who initiated the export operation. Inherited from caseOperation.
createdDateTime	DateTimeOffset	The date and time the export was created. Inherited from caseOperation.
description	String	The description provided for the export.
exportOptions	microsoft.graph.ediscovery.exportOptions	The options provided for the export. For more information, see reviewSet: export. Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.
exportStructure	microsoft.graph.ediscovery.exportFileStructure	The options provided specify the structure of the export. For more information, see reviewSet: export. Possible values are: `none`, `directory`, `pst`.
id	String	The ID for the operation. Read-only. Inherited from caseOperation.
outputFolderId	String	The output folder ID.
outputName	String	The name provided for the export.
percentProgress	Int32	The progress of the operation. Inherited from caseOperation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Inherited from caseOperation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: caseOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: custodian

Property	Type	Description
acknowledgedDateTime	DateTimeOffset	Date and time the custodian acknowledged a hold notification.
applyHoldToSources	Boolean	Identifies whether a custodian's sources were placed on hold during creation.
createdDateTime	DateTimeOffset	Date and time when the custodian was added to the case.
displayName	String	Display name of the custodian.
email	String	Email address of the custodian.
id	String	The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime	DateTimeOffset	Date and time the custodian object was last modified
releasedDateTime	DateTimeOffset	Date and time the custodian was released from the case.
status	microsoft.graph.ediscovery.custodianStatus	Status of the custodian. Possible values are: `active`, `released`.

Graph reference: dataSource

Property	Type	Description
createdBy	identitySet	The user who created the dataSource.
createdDateTime	DateTimeOffset	The date and time the dataSource was created.
displayName	String	The display name of the dataSource, and is the name of the SharePoint site.
id	String	The ID of the **d

Graph reference: estimateStatisticsOperation

Property	Type	Description
action	microsoft.graph.ediscovery.caseAction	The type of operation. The case action for this entity will always be `estimateStatistics`. Read-only. Inherited from caseOperation.
completedDateTime	DateTimeOffset	The date and time the operation was completed. Read-only. Inherited from caseOperation.
createdBy	identitySet	The user who created the operation. Read-only. Inherited from caseOperation.
createdDateTime	DateTimeOffset	The date and time the operation was started. Read-only. Inherited from caseOperation.
id	String	The ID for the operation. Read-only. Inherited from caseOperation.
indexedItemCount	Int64	The estimated count of items for the sourceCollection that matched the content query.
indexedItemsSize	Int64	The estimated size of items for the sourceCollection that matched the content query.
mailboxCount	Int32	The number of mailboxes that had search hits.
percentProgress	Int32	The progress of the operation. Read-only. Inherited from caseOperation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
siteCount	Int32	The number of mailboxes that had search hits.
status	microsoft.graph.ediscovery.caseOperationStatus	The status of the case operation. Inherited from caseOperation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.
unindexedItemCount	Int64	The estimated count of unindexed items for the collection.
unindexedItemsSize	Int64	The estimated size of unindexed items for the collection.

Graph reference: legalHold

Property	Type	Description
contentQuery	String	KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank.
createdBy	identitySet	The user who created the legal hold.
createdDateTime	DateTimeOffset	The date and time the legal hold was created.
description	String	The legal hold description.
displayName	String	The display name of the legal hold.
errors	String collection	Lists any errors that happened while placing the hold.
id	String	The ID for the eDiscovery case. Read-only. Inherited from entity.
isEnabled	Boolean	Indicates whether the hold is enabled and actively holding content.
lastModifiedBy	identitySet	the user who last modified the legal hold.
lastModifiedDateTime	DateTimeOffset	The date and time the legal hold was last modified.
status	microsoft.graph.ediscovery.legalHoldStatus	The status of the legal hold. Possible values are: `Pending`, `Error`, `Success`, `UnknownFutureValue`.

Graph reference: noncustodialDataSource

Property	Type	Description
applyHoldToSource	Boolean	Indicates if hold is applied to noncustodial data source (such as mailbox or site).
createdDateTime	DateTimeOffset	Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
displayName	String	Display name of the noncustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
id	String	Unique identifier of the nonCustodialDataSource. Inherited from entity.
lastModifiedDateTime	DateTimeOffset	Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
releasedDateTime	DateTimeOffset	Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.ediscovery.dataSourceContainer.
status	microsoft.graph.ediscovery.dataSourceContainerStatus	Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. Possible values are: `Active`, `Released`.

Graph reference: reviewSet

Property	Type	Description
createdBy	identitySet	The user who created the review set. Read-only.
createdDateTime	DateTimeOffset	The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
displayName	String	The review set name. The name is unique with a maximum limit of 64 characters.
id	String	The review set unique identifier. Read-only.

Graph reference: reviewSetQuery

Property	Type	Description
createdBy	identitySet	The user who created the query.
createdDateTime	DateTimeOffset	The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
displayName	String	The name of the query.
id	String	The unique identifier of the query. Read-only.
lastModifiedBy	identitySet	The user who last modified the query.
lastModifiedDateTime	DateTimeOffset	The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
query	String	The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in Advanced eDiscovery. This field maps directly to the keywords condition. You can refine searches by using fields listed in the *s

Graph reference: siteSource

Property	Type	Description
createdBy	identitySet	The user who created the siteSource.
createdDateTime	DateTimeOffset	The date and time the siteSource was created.
displayName	String	The display name of the siteSource. This will be the name of the SharePoint site.
id	String	The ID of the **s

Graph reference: sourceCollection

Property	Type	Description
contentQuery	String	The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy	identitySet	The user who created the sourceCollection.
createdDateTime	DateTimeOffset	The date and time the sourceCollection was created.
dataSourceScopes	microsoft.graph.ediscovery.dataSourceScopes	When specified, the collection spans across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.
description	String	The description of the sourceCollection.
displayName	String	The display name of the sourceCollection.
id	String	The ID for the sourceCollection. Read-only.
lastModifiedBy	identitySet	The last user who modified the sourceCollection.
lastModifiedDateTime	DateTimeOffset	The last date and time the **s

Graph reference: tag

Property	Type	Description
childSelectability	microsoft.graph.ediscovery.childSelectability	Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.
createdBy	identitySet	The user who created the tag.
description	String	The description for the tag.
displayName	String	Display name of the tag.
id	String	Unique identifier for the tag.
lastModifiedDateTime	DateTimeOffset	The date and time the tag was last modified.

Graph reference: unifiedGroupSource

Property	Type	Description
createdBy	identitySet	The user who created the unifiedGroupSource.
createdDateTime	DateTimeOffset	The date and time the unifiedGroupSource was created.
displayName	String	The display name of the unified group - This is the name of the group.
id	String	The ID of the unifiedGroupSource. This isn't the ID of the actual group.
includedSources	microsoft.graph.ediscovery.sourceType	Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.

Graph reference: userSource

Property	Type	Description
createdBy	identitySet	The user who created the userSource.
createdDateTime	DateTimeOffset	The date and time the userSource was created
displayName	String	The display name associated with the mailbox and site.
email	String	Email address of the user's mailbox.
id	String	The ID of the userSource. This is not the ID of the actual group
includedSources	microsoft.graph.ediscovery.sourceType	Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.
siteWebUrl	String	The URL of the user's OneDrive for Business site. Read-only.

Graph reference: caseOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: dataSource

Property	Type	Description
createdBy	identitySet	The user who created the dataSource.
createdDateTime	DateTimeOffset	The date and time the dataSource was created.
displayName	String	The display name of the dataSource and is the name of the SharePoint site.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the dataSource.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	The ID of the **d

Graph reference: ediscoveryAddToReviewSetOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: ediscoveryCase

Property	Type	Description
closedBy	microsoft.graph.identitySet	The user who closed the case.
closedDateTime	DateTimeOffset	The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
createdBy	microsoft.graph.identitySet	The user who created the case.
createdDateTime	DateTimeOffset	The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
description	String	The case description.
displayName	String	The case name.
externalId	String	The external case number for customer reference.
id	String	The ID for the eDiscovery case. Read-only.
lastModifiedBy	microsoft.graph.identitySet	The last user who modified the case.
lastModifiedDateTime	DateTimeOffset	The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
status	microsoft.graph.security.caseStatus	The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.

Graph reference: ediscoveryCaseSettings

Property	Type	Description
id	String	The ID of the eDiscovery case. Inherited from entity.
ocr	microsoft.graph.security.ocrSettings	The OCR (Optical Character Recognition) settings for the case.
redundancyDetection	microsoft.graph.security.redundancyDetectionSettings	The redundancy (near duplicate and email threading) detection settings for the case.
topicModeling	microsoft.graph.security.topicModelingSettings	The Topic Modeling (Themes) settings for the case.

Graph reference: ediscoveryCustodian

Property	Type	Description
acknowledgedDateTime	DateTimeOffset	Date and time the custodian acknowledged a hold notification.
createdDateTime	DateTimeOffset	Date and time when the custodian was added to the case.
displayName	String	Display name of the custodian.
email	String	Email address of the custodian.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the custodian.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime	DateTimeOffset	Date and time the custodian object was last modified
releasedDateTime	DateTimeOffset	Date and time the custodian was released from the case.
status	microsoft.graph.security.custodianStatus	Status of the custodian. Possible values are: `active`, `released`.

Graph reference: ediscoveryEstimateOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed. Read-only.
createdBy	identitySet	The user who created the operation. Read-only.
createdDateTime	DateTimeOffset	The date and time the operation was started. Read-only.
id	String	The ID for the operation. Read-only.
indexedItemCount	Int64	The estimated count of items for the search that matched the content query.
indexedItemsSize	Int64	The estimated size of items for the search that matched the content query.
mailboxCount	Int32	The number of mailboxes that had search hits.
percentProgress	Int32	The progress of the operation. Read-only.
resultInfo	resultInfo	Contains success and failure-specific result information.
siteCount	Int32	The number of mailboxes that had search hits.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.
unindexedItemCount	Int64	The estimated count of unindexed items for the collection.
unindexedItemsSize	Int64	The estimated size of unindexed items for the collection.

Graph reference: ediscoveryExportOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the export was completed.
createdBy	identitySet	The user who initiated the export operation.
createdDateTime	DateTimeOffset	The date and time the export was created.
description	String	The description provided for the export.
exportFileMetadata	microsoft.graph.security.ediscoveryExportFileMetadata	Contains the properties for an export file metadata, including downloadUrl, fileName, and size.
exportOptions	microsoft.graph.security.exportOptions	The options provided for the export. For more information, see reviewSet: export. Possible values are: `originalFiles`, `text`, `pdfReplacement`, `tags`.
exportStructure	microsoft.graph.security.exportFileStructure	The options that specify the structure of the export. For more information, see reviewSet: export. Possible values are: `none`, `directory`, `pst`.
id	String	The ID for the operation. Read-only.
outputName	String	The name provided for the export.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information. Inherited from caseOperation.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: ediscoveryFile

Property	Type	Description
content	Stream	The content stream of the original file.
dateTime	DateTimeOffset	The date and time the file was last modified. See dateTime values for more details.
extension	String	The file extension of the file such as png, msg, docx etc.
extractedTextContent	Stream	The extracted text from the original file. For image based files, this would be the OCR text.
id	String	The unique identifier for the file.
mediaType	String	mimeType of the file. for example: text/plain, charset=UTF-8, application/vnd.ms-outlook.
name	String	The name of the file. Subject of the mail for email.
otherProperties	microsoft.graph.security.stringValueDictionary	A list of other properties of the file like titleOfSharepointDocument, emailRecipients. Learn more.
processingStatus	microsoft.graph.security.fileProcessingStatus	The processing status after the item was added to a review set. The possible values are: `success`, `internalError`, `unknownError`, `processingTimeout`, `invalidFileId`, `fileSizeIsZero`, `fileSizeIsTooLarge`, `fileDepthLimitExceeded`, `fileBodyIsTooLong`, `fileTypeIsUnknown`, `fileTypeIsNotSupported`, `malformedFile`, `protectedFile`, `poisonFile`, `noReviewSetSummaryGenerated`, `extractionException`, `ocrProcessingTimeout`, `ocrFileSizeExceedsLimit`.
senderAuthor	String collection	The sender of the email or authors of the document.
size	Int64	size of the file.
sourceType	microsoft.graph.security.sourceType	The original source of the content. The possible values are: `mailbox`, `site`.
subjectTitle	String	The subject of the email or title of the document

Graph reference: ediscoveryHoldOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: ediscoveryHoldPolicy

Property	Type	Description
contentQuery	String	KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank.
createdBy	identitySet	The user who created the legal hold.
createdDateTime	DateTimeOffset	The date and time the legal hold was created.
description	String	The legal hold description.
displayName	String	The display name of the legal hold.
errors	String collection	Lists any errors that happened while placing the hold.
id	String	The ID for the eDiscovery case. Read-only. Inherited from entity.
isEnabled	Boolean	Indicates whether the hold is enabled and actively holding content.
lastModifiedBy	identitySet	the user who last modified the legal hold.
lastModifiedDateTime	DateTimeOffset	The date and time the legal hold was last modified.
status	microsoft.graph.security.policyStatus	The status of the legal hold. Possible values are: `Pending`, `Error`, `Success`.

Graph reference: ediscoveryIndexOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`
completedDateTime	DateTimeOffset	The date and time the operation was completed.
createdBy	identitySet	The user that created the operation.
createdDateTime	DateTimeOffset	The date and time the operation was created.
id	String	The ID for the operation. Read-only.
percentProgress	Int32	The progress of the operation.
resultInfo	resultInfo	Contains success and failure-specific result information.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.

Graph reference: ediscoveryNoncustodialDataSource

Property	Type	Description
createdDateTime	DateTimeOffset	Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer.
displayName	String	Display name of the noncustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the nonCustodialDataSource. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`
id	String	Unique identifier of the nonCustodialDataSource. Inherited from entity.
lastModifiedDateTime	DateTimeOffset	Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer.
releasedDateTime	DateTimeOffset	Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.security.datasourcecontainer.
status	microsoft.graph.security.dataSourceContainerStatus	Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. Possible values are: `Active`, `Released`.

Graph reference: ediscoveryReviewSet

Property	Type	Description
createdBy	microsoft.graph.identitySet	The user who created the review set. Read-only.
createdDateTime	DateTimeOffset	The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
displayName	String	The review set name. The name is unique with a maximum limit of 64 characters.
id	String	The review set unique identifier. Read-only.

Graph reference: ediscoveryReviewSetQuery

Property	Type	Description
contentQuery	String	The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in eDiscovery (Premium). This field maps directly to the keywords condition. You can refine searches by using fields listed in the searchable field name paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy	identitySet	The user who created the query.
createdDateTime	DateTimeOffset	The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
description	String	The description of the eDiscovery search.
displayName	String	The name of the query.
id	String	The unique identifier of the query. Read-only.
lastModifiedBy	identitySet	The user who last modified the query.
lastModifiedDateTime	DateTimeOffset	The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`

Graph reference: ediscoveryReviewTag

Property	Type	Description
childSelectability	microsoft.graph.security.childSelectability	Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.
createdBy	identitySet	The user who created the tag.
description	String	The description for the tag.
displayName	String	Display name of the tag.
id	String	Unique identifier for the tag.
lastModifiedDateTime	DateTimeOffset	The date and time the tag was last modified.

Graph reference: ediscoverySearch

Property	Type	Description
contentQuery	String	The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy	identitySet	The user who created the eDiscovery search.
createdDateTime	DateTimeOffset	The date and time the eDiscovery search was created.
dataSourceScopes	microsoft.graph.security.dataSourceScopes	When specified, the collection spans across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.
description	String	The description of the eDiscovery search.
displayName	String	The display name of the eDiscovery search.
id	String	The ID for the eDiscovery search. Read-only.
lastModifiedBy	identitySet	The last user who modified the eDiscovery search.
lastModifiedDateTime	DateTimeOffset	The last date and time the **e

Graph reference: ediscoverySearchExportOperation

Property	Type	Description
action	microsoft.graph.security.caseAction	The type of action the operation represents. Possible values are: `contentExport`, `applyTags`, `convertToPdf`, `index`, `estimateStatistics`, `addToReviewSet`, `holdUpdate`, `unknownFutureValue`, `purgeData`, `exportReport`, `exportResult`. You must use the `Prefer: include-unknown-enum-members` request header to get the following values from this evolvable enum: `purgeData`, `exportReport`, `exportResult`. Inherited from microsoft.graph.security.caseOperation.
additionalOptions	microsoft.graph.security.additionalOptions	The additional items to include in the export. The possible values are: `none`, `teamsAndYammerConversations`, `cloudAttachments`, `allDocumentVersions`, `subfolderContents`, `listAttachments`, `unknownFutureValue`.
completedDateTime	DateTimeOffset	The date and time when the operation was completed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Inherited from microsoft.graph.security.caseOperation.
createdBy	microsoft.graph.identitySet	The user who created the operation. Inherited from microsoft.graph.security.caseOperation.
createdDateTime	DateTimeOffset	The date and time when the operation was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. Inherited from microsoft.graph.security.caseOperation.
description	String	The name of export provided by the user.
displayName	String	The description of the export by the user.
exportCriteria	microsoft.graph.security.exportCriteria	Items to be included in the export. The possible values are: `searchHits`, `partiallyIndexed`, `unknownFutureValue`.
exportFileMetadata	microsoft.graph.security.ediscoveryExportFileMetadata collection	Contains the properties for an export file metadata, including downloadUrl, fileName, and size.
exportFormat	microsoft.graph.security.exportFormat	Format of the emails of the export. The possible values are: `pst`, `msg`, `eml`, `unknownFutureValue`.
exportLocation	microsoft.graph.security.exportLocation	Location scope for partially indexed items. You can choose to include partially indexed items only in responsive locations with search hits or in all targeted locations. The possible values are: `responsiveLocations`, `nonresponsiveLocations`, `unknownFutureValue`.
exportSingleItems	Boolean	Indicates whether to export single items.
id	String	The ID for the operation. Read-only. Inherited from microsoft.graph.security.caseOperation.
percentProgress	Int32	The progress of the operation. Inherited from microsoft.graph.security.caseOperation.
resultInfo	microsoft.graph.resultInfo	Contains success and failure-specific result information. Inherited from microsoft.graph.security.caseOperation.
status	microsoft.graph.security.caseOperationStatus	The status of the case operation. The possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`, `unknownFutureValue`. Inherited from microsoft.graph.security.caseOperation.