eDiscovery.ReadWrite.All
Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.
Graph Methods
Type: A = Application Permission, D = Delegate Permission
Delegate Permission
|
|
Id |
acb8f680-0834-4146-b69e-4ab1b39745ad |
Consent Type |
Admin |
Display String |
Read and write all eDiscovery objects |
Description |
Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user. |
Application Permission
|
|
Id |
b2620db1-3bf7-4c5b-9cb9-576d29eac736 |
Display String |
Read and write all eDiscovery objects |
Description |
Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user. |
Resources
Property |
Type |
Description |
action |
microsoft.graph.ediscovery.caseAction |
The case action for this entity will always be addToReviewSet . Read-only. Inherited from caseOperation. |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. Read-only. Inherited from caseOperation |
createdBy |
identitySet |
The user who created the operation. Read-only. Inherited from caseOperation |
createdDateTime |
DateTimeOffset |
The date and time the operation was started. Read-only. Inherited from caseOperation |
id |
String |
The ID for the operation. Read-only. Inherited from caseOperation. |
percentProgress |
Int32 |
The progress of the operation. Read-only. Inherited from caseOperation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. Inherited from caseOperation. |
status |
microsoft.graph.ediscovery.caseOperationStatus |
The status of the case operation. Inherited from caseOperation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
closedBy |
identitySet |
The user who closed the case. |
closedDateTime |
DateTimeOffset |
The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
createdBy |
identitySet |
The user who created the case. |
createdDateTime |
DateTimeOffset |
The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
description |
String |
The case description. |
displayName |
String |
The case name. |
externalId |
String |
The external case number for customer reference. |
id |
String |
The ID for the eDiscovery case. Read-only. |
lastModifiedBy |
identitySet |
The last user who modified the entity. |
lastModifiedDateTime |
DateTimeOffset |
The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
status |
microsoft.graph.ediscovery.caseStatus |
The case status. Possible values are unknown , active , pendingDelete , closing , closed , and closedWithError . For details, see the following table. |
Property |
Type |
Description |
action |
microsoft.graph.ediscovery.caseAction |
The case action for this entity will always be contentExport . Inherited from caseOperation. |
azureBlobContainer |
String |
The name of the Azure storage location where the export will be stored. This only applies to exports stored in your own Azure storage location. |
azureBlobToken |
String |
The SAS token for the Azure storage location. This only applies to exports stored in your own Azure storage location. |
completedDateTime |
DateTimeOffset |
The date and time the export was completed. Inherited from caseOperation. |
createdBy |
identitySet |
The user who initiated the export operation. Inherited from caseOperation. |
createdDateTime |
DateTimeOffset |
The date and time the export was created. Inherited from caseOperation. |
description |
String |
The description provided for the export. |
exportOptions |
microsoft.graph.ediscovery.exportOptions |
The options provided for the export. For more details, see reviewSet: export. Possible values are: originalFiles , text , pdfReplacement , fileInfo , tags . |
exportStructure |
microsoft.graph.ediscovery.exportFileStructure |
The options provided that specify the structure of the export. For more details, see reviewSet: export. Possible values are: none , directory , pst . |
id |
String |
The ID for the operation. Read-only. Inherited from caseOperation. |
outputName |
String |
The name provided for the export. |
percentProgress |
Int32 |
The progress of the operation. Inherited from caseOperation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. Inherited from caseOperation. |
status |
microsoft.graph.ediscovery.caseOperationStatus |
The status of the case operation. Inherited from caseOperation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
action |
microsoft.graph.ediscovery.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
status |
microsoft.graph.ediscovery.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
acknowledgedDateTime |
DateTimeOffset |
Date and time the custodian acknowledged a hold notification. |
applyHoldToSources |
Boolean |
Identifies whether a custodian's sources were placed on hold during creation. |
createdDateTime |
DateTimeOffset |
Date and time when the custodian was added to the case. |
displayName |
String |
Display name of the custodian. |
email |
String |
Email address of the custodian. |
id |
String |
The ID for the custodian in the specified case. Read-only. |
lastModifiedDateTime |
DateTimeOffset |
Date and time the custodian object was last modified |
releasedDateTime |
DateTimeOffset |
Date and time the custodian was released from the case. |
status |
microsoft.graph.ediscovery.custodianStatus |
Status of the custodian. Possible values are: active , released . |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the dataSource. |
createdDateTime |
DateTimeOffset |
The date and time the dataSource was created. |
displayName |
String |
The display name of the dataSource. This will be the name of the SharePoint site. |
id |
String |
The ID of the **d |
Property |
Type |
Description |
action |
microsoft.graph.ediscovery.caseAction |
The type of operation. The case action for this entity will always be estimateStatistics . Read-only. Inherited from caseOperation. |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. Read-only. Inherited from caseOperation. |
createdBy |
identitySet |
The user who created the operation. Read-only. Inherited from caseOperation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was started. Read-only. Inherited from caseOperation. |
id |
String |
The ID for the operation. Read-only. Inherited from caseOperation. |
indexedItemCount |
Int64 |
The estimated count of items for the sourceCollection that matched the content query. |
indexedItemsSize |
Int64 |
The estimated size of items for the sourceCollection that matched the content query. |
mailboxCount |
Int32 |
The number of mailboxes that had search hits. |
percentProgress |
Int32 |
The progress of the operation. Read-only. Inherited from caseOperation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. Inherited from caseOperation. |
siteCount |
Int32 |
The number of mailboxes that had search hits. |
status |
microsoft.graph.ediscovery.caseOperationStatus |
The status of the case operation. Inherited from caseOperation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
unindexedItemCount |
Int64 |
The estimated count of unindexed items for the collection. |
unindexedItemsSize |
Int64 |
The estimated size of unindexed items for the collection. |
Property |
Type |
Description |
contentQuery |
String |
KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank. |
createdBy |
identitySet |
The user who created the legal hold. |
createdDateTime |
DateTimeOffset |
The date and time the legal hold was created. |
description |
String |
The legal hold description. |
displayName |
String |
The display name of the legal hold. |
errors |
String collection |
Lists any errors that happened while placing the hold. |
id |
String |
The ID for the eDiscovery case. Read-only. Inherited from entity. |
isEnabled |
Boolean |
Indicates whether the hold is enabled and actively holding content. |
lastModifiedBy |
identitySet |
the user who last modified the legal hold. |
lastModifiedDateTime |
DateTimeOffset |
The date and time the legal hold was last modified. |
status |
microsoft.graph.ediscovery.legalHoldStatus |
The status of the legal hold. Possible values are: Pending , Error , Success , UnknownFutureValue . |
Property |
Type |
Description |
applyHoldToSource |
Boolean |
Indicates if hold is applied to non-custodial data source (such as mailbox or site). |
createdDateTime |
DateTimeOffset |
Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
displayName |
String |
Display name of the noncustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
id |
String |
Unique identifier of the nonCustodialDataSource. Inherited from entity. |
lastModifiedDateTime |
DateTimeOffset |
Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
releasedDateTime |
DateTimeOffset |
Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.ediscovery.dataSourceContainer. |
status |
microsoft.graph.ediscovery.dataSourceContainerStatus |
Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.ediscovery.dataSourceContainer. Possible values are: Active , Released . |
Property |
Type |
Description |
action |
microsoft.graph.ediscovery.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics ,purgeData . |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
status |
microsoft.graph.ediscovery.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the review set. Read-only. |
createdDateTime |
DateTimeOffset |
The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . Read-only. |
displayName |
String |
The review set name. The name is unique with a maximum limit of 64 characters. |
id |
String |
The review set unique identifier. Read-only. |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the query. |
createdDateTime |
DateTimeOffset |
The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
displayName |
String |
The name of the query. |
id |
String |
The unique identifier of the query. Read-only. |
lastModifiedBy |
identitySet |
The user who last modified the query. |
lastModifiedDateTime |
DateTimeOffset |
The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
query |
String |
The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in Advanced eDiscovery. This field maps directly to the keywords condition. You can refine searches by using fields listed in the *s |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the siteSource. |
createdDateTime |
DateTimeOffset |
The date and time the siteSource was created. |
displayName |
String |
The display name of the siteSource. This will be the name of the SharePoint site. |
id |
String |
The ID of the **s |
Property |
Type |
Description |
contentQuery |
String |
The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016. |
createdBy |
identitySet |
The user who created the sourceCollection. |
createdDateTime |
DateTimeOffset |
The date and time the sourceCollection was created. |
dataSourceScopes |
microsoft.graph.ediscovery.dataSourceScopes |
When specified, the collection will span across a service for an entire workload. Possible values are: none , allTenantMailboxes , allTenantSites , allCaseCustodians , allCaseNoncustodialDataSources . |
description |
String |
The description of the sourceCollection. |
displayName |
String |
The display name of the sourceCollection. |
id |
String |
The ID for the sourceCollection. Read-only. |
lastModifiedBy |
identitySet |
The last user who modified the sourceCollection. |
lastModifiedDateTime |
DateTimeOffset |
The last date and time the **s |
Property |
Type |
Description |
childSelectability |
microsoft.graph.ediscovery.childSelectability |
Indicates whether a single or multiple child tags can be associated with a document. Possible values are: One , Many . This value controls whether the UX presents the tags as checkboxes or a radio button group. |
createdBy |
identitySet |
The user who created the tag. |
description |
String |
The description for the tag. |
displayName |
String |
Display name of the tag. |
id |
String |
Unique identifier for the tag. |
lastModifiedDateTime |
DateTimeOffset |
The date and time the tag was last modified. |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the unifiedGroupSource. |
createdDateTime |
DateTimeOffset |
The date and time the unifiedGroupSource was created. |
displayName |
String |
The display name of the unified group - This is the name of the group. |
id |
String |
The ID of the unifiedGroupSource. This is not the ID of the actual group. |
includedSources |
microsoft.graph.ediscovery.sourceType |
Specifies which sources are included in this group. Possible values are: mailbox , site . |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the userSource. |
createdDateTime |
DateTimeOffset |
The date and time the userSource was created |
displayName |
String |
The display name associated with the mailbox and site. |
email |
String |
Email address of the user's mailbox. |
id |
String |
The ID of the userSource. This is not the ID of the actual group |
includedSources |
microsoft.graph.ediscovery.sourceType |
Specifies which sources are included in this group. Possible values are: mailbox , site . |
siteWebUrl |
String |
The URL of the user's OneDrive for Business site. Read-only. |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the dataSource. |
createdDateTime |
DateTimeOffset |
The date and time the dataSource was created. |
displayName |
String |
The display name of the dataSource. This will be the name of the SharePoint site. |
holdStatus |
microsoft.graph.security.dataSourceHoldStatus |
The hold status of the dataSource.The possible values are: notApplied , applied , applying , removing , partial |
id |
String |
The ID of the **d |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
closedBy |
microsoft.graph.identitySet |
The user who closed the case. |
closedDateTime |
DateTimeOffset |
The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
createdBy |
microsoft.graph.identitySet |
The user who created the case. |
createdDateTime |
DateTimeOffset |
The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
description |
String |
The case description. |
displayName |
String |
The case name. |
externalId |
String |
The external case number for customer reference. |
id |
String |
The ID for the eDiscovery case. Read-only. |
lastModifiedBy |
microsoft.graph.identitySet |
The last user who modified the case. |
lastModifiedDateTime |
DateTimeOffset |
The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
status |
microsoft.graph.security.caseStatus |
The case status. Possible values are unknown , active , pendingDelete , closing , closed , and closedWithError . For details, see the following table. |
Property |
Type |
Description |
id |
String |
The ID of the eDiscovery case. Inherited from entity. |
ocr |
microsoft.graph.security.ocrSettings |
The OCR (Optical Character Recognition) settings for the case. |
redundancyDetection |
microsoft.graph.security.redundancyDetectionSettings |
The redundancy (near duplicate and email threading) detection settings for the case. |
topicModeling |
microsoft.graph.security.topicModelingSettings |
The Topic Modeling (Themes) settings for the case. |
Property |
Type |
Description |
acknowledgedDateTime |
DateTimeOffset |
Date and time the custodian acknowledged a hold notification. |
createdDateTime |
DateTimeOffset |
Date and time when the custodian was added to the case. |
displayName |
String |
Display name of the custodian. |
email |
String |
Email address of the custodian. |
holdStatus |
microsoft.graph.security.dataSourceHoldStatus |
The hold status of the custodian.The possible values are: notApplied , applied , applying , removing , partial |
id |
String |
The ID for the custodian in the specified case. Read-only. |
lastModifiedDateTime |
DateTimeOffset |
Date and time the custodian object was last modified |
releasedDateTime |
DateTimeOffset |
Date and time the custodian was released from the case. |
status |
microsoft.graph.security.custodianStatus |
Status of the custodian. Possible values are: active , released . |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. Read-only. |
createdBy |
identitySet |
The user who created the operation. Read-only. |
createdDateTime |
DateTimeOffset |
The date and time the operation was started. Read-only. |
id |
String |
The ID for the operation. Read-only. |
indexedItemCount |
Int64 |
The estimated count of items for the search that matched the content query. |
indexedItemsSize |
Int64 |
The estimated size of items for the search that matched the content query. |
mailboxCount |
Int32 |
The number of mailboxes that had search hits. |
percentProgress |
Int32 |
The progress of the operation. Read-only. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
siteCount |
Int32 |
The number of mailboxes that had search hits. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
unindexedItemCount |
Int64 |
The estimated count of unindexed items for the collection. |
unindexedItemsSize |
Int64 |
The estimated size of unindexed items for the collection. |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
azureBlobContainer |
String |
The name of the Azure storage location where the export will be stored. This only applies to exports stored in your own Azure storage location. |
azureBlobToken |
String |
The SAS token for the Azure storage location. This only applies to exports stored in your own Azure storage location. |
completedDateTime |
DateTimeOffset |
The date and time the export was completed. |
createdBy |
identitySet |
The user who initiated the export operation. |
createdDateTime |
DateTimeOffset |
The date and time the export was created. |
description |
String |
The description provided for the export. |
exportOptions |
microsoft.graph.security.exportOptions |
The options provided for the export. For more details, see reviewSet: export. Possible values are: originalFiles , text , pdfReplacement , fileInfo , tags . |
exportStructure |
microsoft.graph.security.exportFileStructure |
The options provided that specify the structure of the export. For more details, see reviewSet: export. Possible values are: none , directory , pst . |
id |
String |
The ID for the operation. Read-only. |
outputName |
String |
The name provided for the export. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. Inherited from caseOperation. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
content |
Stream |
The content stream of the original file. |
dateTime |
DateTimeOffset |
The datetime the file was last modified. See dateTime values for more details. |
extension |
String |
The file extension of the file such as png, msg, docx etc. |
extractedTextContent |
Stream |
The extracted text from the original file. For image based files, this would be the OCR text. |
id |
String |
The unique identifier for the file. |
mediaType |
String |
mimeType of the file. Eg: text/plain, charset=UTF-8, application/vnd.ms-outlook. |
name |
String |
The name of the file. Subject of the mail in case of email. |
otherProperties |
microsoft.graph.security.stringValueDictionary |
A list of additional properties of the file like titleOfSharepointDocument, emailRecipients. Learn more. |
processingStatus |
microsoft.graph.security.fileProcessingStatus |
The processing status after the item was added to a review set. The possible values are: success , internalError , unknownError , processingTimeout , invalidFileId , fileSizeIsZero , fileSizeIsTooLarge , fileDepthLimitExceeded , fileBodyIsTooLong , fileTypeIsUnknown , fileTypeIsNotSupported , malformedFile , protectedFile , poisonFile , noReviewSetSummaryGenerated , extractionException , ocrProcessingTimeout , ocrFileSizeExceedsLimit . |
senderAuthor |
String collection |
The sender of the email or authors of the document. |
size |
Int64 |
size of the file. |
sourceType |
microsoft.graph.security.sourceType |
The original source of the content. The possible values are: mailbox , site . |
subjectTitle |
String |
The subject of the email or title of the document |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
contentQuery |
String |
KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank. |
createdBy |
identitySet |
The user who created the legal hold. |
createdDateTime |
DateTimeOffset |
The date and time the legal hold was created. |
description |
String |
The legal hold description. |
displayName |
String |
The display name of the legal hold. |
errors |
String collection |
Lists any errors that happened while placing the hold. |
id |
String |
The ID for the eDiscovery case. Read-only. Inherited from entity. |
isEnabled |
Boolean |
Indicates whether the hold is enabled and actively holding content. |
lastModifiedBy |
identitySet |
the user who last modified the legal hold. |
lastModifiedDateTime |
DateTimeOffset |
The date and time the legal hold was last modified. |
status |
microsoft.graph.security.policyStatus |
The status of the legal hold. Possible values are: Pending , Error , Success . |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet ,applyTags ,contentExport ,convertToPdf ,estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success and failure-specific result information. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
createdDateTime |
DateTimeOffset |
Created date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. |
displayName |
String |
Display name of the noncustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. |
holdStatus |
microsoft.graph.security.dataSourceHoldStatus |
The hold status of the nonCustodialDataSource.The possible values are: notApplied , applied , applying , removing , partial |
id |
String |
Unique identifier of the nonCustodialDataSource. Inherited from entity. |
lastModifiedDateTime |
DateTimeOffset |
Last modified date and time of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. |
releasedDateTime |
DateTimeOffset |
Date and time that the nonCustodialDataSource was released from the case. Inherited from microsoft.graph.security.datasourcecontainer. |
status |
microsoft.graph.security.dataSourceContainerStatus |
Latest status of the nonCustodialDataSource. Inherited from microsoft.graph.security.datasourcecontainer. Possible values are: Active , Released . |
Property |
Type |
Description |
action |
microsoft.graph.security.caseAction |
The type of action the operation represents. Possible values are: addToReviewSet , applyTags , contentExport , convertToPdf , estimateStatistics , purgeData |
completedDateTime |
DateTimeOffset |
The date and time the operation was completed. |
createdBy |
identitySet |
The user that created the operation. |
createdDateTime |
DateTimeOffset |
The date and time the operation was created. |
id |
String |
The ID for the operation. Read-only. |
percentProgress |
Int32 |
The progress of the operation. |
resultInfo |
resultInfo |
Contains success- and failure-specific result information. |
status |
microsoft.graph.security.caseOperationStatus |
The status of the case operation. Possible values are: notStarted , submissionFailed , running , succeeded , partiallySucceeded , failed . |
Property |
Type |
Description |
createdBy |
microsoft.graph.identitySet |
The user who created the review set. Read-only. |
createdDateTime |
DateTimeOffset |
The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . Read-only. |
displayName |
String |
The review set name. The name is unique with a maximum limit of 64 characters. |
id |
String |
The review set unique identifier. Read-only. |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the query. |
createdDateTime |
DateTimeOffset |
The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
displayName |
String |
The name of the query. |
id |
String |
The unique identifier of the query. Read-only. |
lastModifiedBy |
identitySet |
The user who last modified the query. |
lastModifiedDateTime |
DateTimeOffset |
The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z |
query |
String |
The query string in KQL (Keyword Query Language) query. For details, see Document metadata fields in eDiscovery (Premium). This field maps directly to the keywords condition. You can refine searches by using fields listed in the *s |
Property |
Type |
Description |
childSelectability |
microsoft.graph.security.childSelectability |
Indicates whether a single or multiple child tags can be associated with a document. Possible values are: One , Many . This value controls whether the UX presents the tags as checkboxes or a radio button group. |
createdBy |
identitySet |
The user who created the tag. |
description |
String |
The description for the tag. |
displayName |
String |
Display name of the tag. |
id |
String |
Unique identifier for the tag. |
lastModifiedDateTime |
DateTimeOffset |
The date and time the tag was last modified. |
Property |
Type |
Description |
contentQuery |
String |
The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016. |
createdBy |
identitySet |
The user who created the eDiscovery search. |
createdDateTime |
DateTimeOffset |
The date and time the eDiscovery search was created. |
dataSourceScopes |
microsoft.graph.security.dataSourceScopes |
When specified, the collection will span across a service for an entire workload. Possible values are: none , allTenantMailboxes , allTenantSites , allCaseCustodians , allCaseNoncustodialDataSources . |
description |
String |
The description of the eDiscovery search. |
displayName |
String |
The display name of the eDiscovery search. |
id |
String |
The ID for the eDiscovery search. Read-only. |
lastModifiedBy |
identitySet |
The last user who modified the eDiscovery search. |
lastModifiedDateTime |
DateTimeOffset |
The last date and time the **e |
Property |
Type |
Description |
isEnabled |
Boolean |
Indicates whether or not OCR is enabled for the case. |
maxImageSize |
Int32 |
Maximum image size that will be processed in KB). |
timeout |
Duration |
The timeout duration for the OCR engine. A longer timeout might increase success of OCR, but might add to the total processing time. |
Property |
Type |
Description |
isEnabled |
Boolean |
Indicates whether email threading and near duplicate detection are enabled. |
maxWords |
Int32 |
Specifies the maximum number of words used for email threading and near duplicate detection. To learn more, see Minimum/maximum number of words. |
minWords |
Int32 |
Specifies the minimum number of words used for email threading and near duplicate detection. To learn more, see Minimum/maximum number of words. |
similarityThreshold |
Int32 |
Specifies the similarity level for documents to be put in the same near duplicate set. To learn more, see Document and email similarity threshold. |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the siteSource. |
createdDateTime |
DateTimeOffset |
The date and time the siteSource was created. |
displayName |
String |
The display name of the siteSource. This will be the name of the SharePoint site. |
id |
String |
The ID of the siteSource. |
holdStatus |
microsoft.graph.security.dataSourceHoldStatus |
The hold status of the **s |
Property |
Type |
Description |
dynamicallyAdjustTopicCount |
Boolean |
Indicates whether the themes model should dynamically optimize the number of generated topics. To learn more, see Adjust maximum number of themes dynamically. |
ignoreNumbers |
Boolean |
Indicates whether the themes model should exclude numbers while parsing document texts. To learn more, see Include numbers in themes. |
isEnabled |
Boolean |
Indicates whether themes model is enabled for the case. |
topicCount |
Int32 |
The total number of topics that the themes model will generate for a review set. To learn more, see Maximum number of themes. |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the unifiedGroupSource. |
createdDateTime |
DateTimeOffset |
The date and time the unifiedGroupSource was created. |
displayName |
String |
The display name of the unified group, which is the name of the group. |
holdStatus |
microsoft.graph.security.dataSourceHoldStatus |
The hold status of the unifiedGroupSource. The possible values are: notApplied , applied , applying , removing , partial |
id |
String |
The ID of the unifiedGroupSource. This is not the ID of the actual group. |
includedSources |
microsoft.graph.security.sourceType |
Specifies which sources are included in this group. Possible values are: mailbox , site . |
Property |
Type |
Description |
createdBy |
identitySet |
The user who created the userSource. |
createdDateTime |
DateTimeOffset |
The date and time the userSource was created. |
displayName |
String |
The display name associated with the mailbox and site. |
email |
String |
Email address of the user's mailbox. |
holdStatus |
microsoft.graph.security.dataSourceHoldStatus |
The hold status of the userSource. The possible values are: notApplied , applied , applying , removing , partial . |
id |
String |
The ID of the userSource. This is not the ID of the actual group. |
includedSources |
microsoft.graph.security.sourceType |
Specifies which sources are included in this group. Possible values are: mailbox , site . |
siteWebUrl |
String |
The URL of the user's OneDrive for Business site. Read-only. |