Updates from: 07/19/2022 01:15:13
Service Microsoft Docs article Related commit history on GitHub Change details
v1.0 Security Caseoperation Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-caseoperation-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a [caseOperation](../resources/security-caseoperation.md) object in the response body.
+If successful, this method returns a `200 OK` response code and a [microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Casesroot Delete Ediscoverycases https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-casesroot-delete-ediscoverycases.md
Title: "Delete ediscoveryCase"
-description: "Deletes an ediscoveryCase."
+description: "Delete an ediscoveryCase."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Deletes an [ediscoveryCase](../resources/security-ediscoverycase.md) object.
+Delete an [ediscoveryCase](../resources/security-ediscoverycase.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
DELETE https://graph.microsoft.com/beta/security/cases/eDiscoverycases/22aa2acd-
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Casesroot List Ediscoverycases https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-casesroot-list-ediscoverycases.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryCase](../resources/security-ediscoverycase.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/ediscoveryCases
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Casesroot Post Ediscoverycases https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-casesroot-post-ediscoverycases.md
POST /security/cases/ediscoveryCases
## Request body In the request body, supply a JSON representation of the [ediscoveryCase](../resources/security-ediscoverycase.md) object.
-You can specify the following properties when creating an **ediscoveryCase**.
+You can specify the following properties when you create an **ediscoveryCase**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating an **ediscoveryCase**.
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Delete Legalholds https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-delete-legalholds.md
Title: "Delete ediscoveryHoldPolicy"
-description: "Deletes an ediscoveryHoldPolicy object."
+description: "Delete an ediscoveryHoldPolicy object."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Deletes an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.
+Delete an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
DELETE https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycase Delete Searches https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-delete-searches.md
Title: "Delete ediscoverySearch"
-description: "Deletes an ediscoverySearch object."
+description: "Delete an ediscoverySearch object."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Deletes an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
+Delete an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
DELETE https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycase Delete Tags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-delete-tags.md
DELETE https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycase Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/22aa2acd-755
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Custodians https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-custodians.md
GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
Do not supply a request body for this method. ## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Legalholds https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-legalholds.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Noncustodialdatasources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-noncustodialdatasources.md
Title: "List ediscoveryNoncustodialDataSource"
-description: "Get a list of the ediscoveryNoncustodialDataSource object."
+ Title: "List ediscoveryNoncustodialDataSources"
+description: "Get a list of ediscoveryNoncustodialDataSource objects."
ms.localizationpriority: medium ms.prod: "ediscovery" doc_type: "apiPageType"
-# List ediscoveryNoncustodialDataSource
+# List ediscoveryNoncustodialDataSources
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get a list of the [non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md) objects and their properties.
+Get a list of the [non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md) and their properties.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Operations https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-operations.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [caseOperation](../resources/security-caseoperation.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Reviewsets https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-reviewsets.md
Title: "List ediscoveryReviewSet"
+ Title: "List reviewSets"
description: "Get the ediscoveryReviewSet resources from an eDiscovery case object" ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# List ediscoveryReviewSet
+# List reviewSets
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) resources from the reviewSet navigation property.
+Get a list of [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects associated with an eDiscovery case.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Searches https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-searches.md
Title: "List ediscoverySearch"
+ Title: "List searches"
description: "Get the list of searches from an eDiscovery case" ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# List ediscoverySearch
+# List searches
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the list of [ediscoverySearch](../resources/security-ediscoverysearch.md) resources from from a [eDiscoveryCase](../resources/security-ediscoverycase.md) object.
+Get the list of [ediscoverySearch](../resources/security-ediscoverysearch.md) resources from an [eDiscoveryCase](../resources/security-ediscoverycase.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoverySearch](../resources/security-ediscoverysearch.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase List Tags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-list-tags.md
Title: "List ediscoveryReviewTag"
+ Title: "List tags"
description: "Get the list of ediscoveryReviewTag objects from an eDiscovery case object." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# List ediscoveryReviewTag
+# List tags
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new ediscoveryReviewTag object.
+Get a list of [eDiscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) objects and their properties.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
Do not supply a request body for this method. ## Response
-If successful, this method returns a `200 OK` response code.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryreviewtag](../resources/security-ediscoveryreviewtag.md) objects in the response body.
+ ## Examples ### Request
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Post Custodians https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-post-custodians.md
Title: "Create ediscoveryCustodian"
+ Title: "Create custodians"
description: "Create a new ediscoveryCustodian object." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Create ediscoveryCustodian
+# Create custodians
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
## Request body In the request body, supply a JSON representation of the [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object.
-You can specify the following properties when creating an **ediscoveryCustodian**.
+You can specify the following properties when you create an **ediscoveryCustodian**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating an **ediscoveryCustodian*
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Post Legalholds https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-post-legalholds.md
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds
## Request body In the request body, supply a JSON representation of the [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.
-You can specify the following properties when creating an **ediscoveryHoldPolicy**.
+You can specify the following properties when you create an **ediscoveryHoldPolicy**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating an **ediscoveryHoldPolicy
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Post Noncustodialdatasources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-post-noncustodialdatasources.md
Title: "Create ediscoveryNoncustodialDataSource"
+ Title: "Create nonCustodialDataSources"
description: "Create a new ediscoveryNoncustodialDataSource object." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Create ediscoveryNoncustodialDataSource
+# Create nonCustodialDataSources
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new ediscoveryNoncustodialDataSource object.
+Create a new [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
You can specify the following properties when creating an **ediscoveryNoncustodi
|Property|Type|Description| |:|:|:|
-|dataSource|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Required. Either a userSource or siteSource. For userSource, use "dataSource" : { "@odata.type" : "microsoft.graph.security.userSource", "email" : "SMTP address"}. For site source use "dataSource" : { "@odata.type" : "microsoft.graph.security.siteSource", "site@odata.bind" : "siteId" }, where siteId can be derived from the site URL, e.g. `https://contoso.sharepoint.com/sites/HumanResources`, the Microsoft Graph request would be `https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/HumanResources`. The ID is the first GUID listed in the ID field. Alternatively use the webUrl directly, "dataSource": {"@odata.type": "microsoft.graph.security.siteSource","site": {"webUrl": `https://m365x809305.sharepoint.com/sites/Design-topsecret`}}
-
+|dataSource|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Required. Either a [microsoft.graph.security.userSource](../resources/security-usersource.md) or [microsoft.graph.security.siteSource](../resources/security-sitesource.md).
+For userSource, use "dataSource" : { "@odata.type" : "microsoft.graph.security.userSource", "email" : "SMTP address"}.
+For siteSource use "dataSource" : { "@odata.type" : "microsoft.graph.security.siteSource", "site@odata.bind" : "siteId" },
+Alternatively use the webUrl directly, "dataSource": {"@odata.type": "microsoft.graph.security.siteSource","site": {"webUrl": `https://m365x809305.sharepoint.com/sites/Design-topsecret`}}
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Post Reviewsets https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-post-reviewsets.md
Title: "Create ediscoveryReviewSet"
+ Title: "Create reviewSets"
description: "Create a new ediscoveryReviewSet object." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Create ediscoveryReviewSet
+# Create reviewSets
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
## Request body In the request body, supply a JSON representation of the [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.
-You can specify the following properties when creating an **ediscoveryReviewSet**.
+You can specify the following properties when you create an **ediscoveryReviewSet**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating an **ediscoveryReviewSet*
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Post Searches https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-post-searches.md
Title: "Create ediscoverySearch"
+ Title: "Create searches"
description: "Create a new ediscoverySearch object." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Create ediscoverySearch
+# Create searches
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
## Request body In the request body, supply a JSON representation of the [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
-You can specify the following properties when creating an **ediscoverySearch**.
+You can specify the following properties when you create an **ediscoverySearch**.
|Property|Type|Description| |:|:|:| |displayName|String|The display name of the search. Required| |description|String|The description of the search Optional.| |contentQuery|String|The query string used for the search. The query string in KQL (Keyword Query Language) format. Optional|
-|dataSourceScopes|String|The option to search across all mailboxes or sites in the tenant. The possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`. Optional.|
+|dataSourceScopes|microsoft.graph.security.dataSourceScopes|The option to search across all mailboxes or sites in the tenant. The possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`. Optional.|
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Post Tags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-post-tags.md
Title: "Create ediscoveryReviewTag"
+ Title: "Create tags"
description: "Create a new ediscoveryReviewTag object." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Create ediscoveryReviewTag
+# Create tags
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new ediscoveryReviewTag object.
+Create a new [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
## Request body In the request body, supply a JSON representation of the [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
-You can specify the following properties when creating an **ediscoveryReviewTag**.
+You can specify the following properties when you create an **ediscoveryReviewTag**.
|Property|Type|Description| |:|:|:| |displayName|String|Display name of the tag. Required.| |description|String|Description of the tag. Optional.|
-|childSelectability|String|This value controls whether the UX presents the tags as checkboxes or a radio button group. The possible values are: `One`, `Many`. Required.|
+|childSelectability|microsoft.graph.security.childSelectability|This value controls whether the UX presents the tags as checkboxes or a radio button group. The possible values are: `One`, `Many`. Required.|
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object in the response body.
## Examples
-### Create a tag
+### Example 1: Create a tag
#### Request The following is an example of a request.
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ce
#### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
Content-Type: application/json
} ```
-### Create a tag with a parent
+### Example 2: Create a tag with a parent
#### Request The following is an example of a request. <!-- {
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ce
#### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycase Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycase-update.md
In the request body, supply the values for relevant fields that should be update
## Response
-If successful, this method returns a `204 NO CONTENT` response code and an updated [ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
+If successful, this method returns a `204 NO CONTENT` response code and an updated [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycasesettings Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycasesettings-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycasesettings Resettodefault https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycasesettings-resettodefault.md
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
->**Note:** The response object shown here might be shortened for readability.
<!-- { "blockType": "response", "truncated": true
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
--> ``` http
-HTTP/1.1 202 Accepted
+HTTP/1.1 200 OK
```
v1.0 Security Ediscoverycasesettings Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycasesettings-update.md
PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
|Property|Type|Description| |:|:|:|
-|redundancyDetection|[microsoft.graph.security.redundancyDetectionSettings](../resources/security-redundancydetectionsettings.md)|**TODO: Add Description** Optional.|
-|topicModeling|[microsoft.graph.security.topicModelingSettings](../resources/security-topicmodelingsettings.md)|**TODO: Add Description** Optional.|
-|ocr|[microsoft.graph.security.ocrSettings](../resources/security-ocrsettings.md)|**TODO: Add Description** Optional.|
+|redundancyDetection|[microsoft.graph.security.redundancyDetectionSettings](../resources/security-redundancydetectionsettings.md)|Redundancy (email threading and near duplicate detection) settings for an eDiscovery case. Optional.|
+|topicModeling|[microsoft.graph.security.topicModelingSettings](../resources/security-topicmodelingsettings.md)|Topic modeling (Themes) settings for an eDiscovery case. Optional.|
+|ocr|[microsoft.graph.security.ocrSettings](../resources/security-ocrsettings.md)|The OCR (Optical Character Recognition) settings for the eDiscovery case. Optional.|
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycustodian Activate https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-activate.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Activate a custodian that has been released from a case to make them part of the case again. For details, see [Manage custodians in an Advanced eDiscovery case](/microsoft-365/compliance/manage-new-custodians#re-activate-custodian).
+Activate a custodian that has been released from a case to make them part of the case again. For details, see [Manage custodians in an eDiscovery (Premium) case](/microsoft-365/compliance/manage-new-custodians#re-activate-custodian).
## Permissions
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/{ediscovery
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycustodian Applyhold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-applyhold.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Start the process of applying hold to eDiscovery custodians. After the operation is created, you can get the status of the case operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [eDiscoveryHoldOpertaion](../resources/security-ediscoveryholdoperation.md).
+Start the process of applying hold on [eDiscovery custodians](../resources/security-ediscoverycustodian.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
If successful, this action returns a `202 Accepted` response code.
## Examples
-### Example 1. Apply hold to multiple custodians.
+### Example 1: Apply hold to multiple custodian
#### Request The following is an example of a request.
Content-Type: application/json
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
The following is an example of the response
HTTP/1.1 202 Accepted ```
-### Example 2. Apply hold to a single custodian.
+### Example 2: Apply hold to a single custodian
#### Request The following is an example of a request.
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycustodian Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian List Lastindexoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-list-lastindexoperation.md
Title: "List ediscoveryIndexOperation"
+ Title: "List lastIndexOperation"
description: "Get the ediscoveryIndexOperation resources from the lastIndexOperation navigation property." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: apiPageType
-# List ediscoveryIndexOperation
+# List lastIndexOperation
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the ediscoveryIndexOperation resources from the lastIndexOperation navigation property.
+Get a list of the [ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian List Sitesources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-list-sitesources.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the siteSource resources from the siteSources navigation property.
+Get a list of the [siteSource](../resources/security-sitesource.md) objects associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [siteSource](../resources/security-sitesource.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.siteSource](../resources/security-sitesource.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian List Unifiedgroupsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-list-unifiedgroupsources.md
ms.prod: "ediscovery"
doc_type: apiPageType
-# List custodian's unifiedGroupSources
+# List unifiedGroupSources
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get a list of the [unifiedGroupSource](../resources/security-unifiedgroupsource.md) objects and their properties.
+Get a list of the [unifiedGroupSource](../resources/security-unifiedgroupsource.md) objects associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [unifiedGroupSource](../resources/security-unifiedgroupsource.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian List Usersources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-list-usersources.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the userSource resources from the userSources navigation property.
+Get a list of the [userSource](../resources/security-usersource.md) objects associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [userSource](../resources/security-usersource.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.userSource](../resources/security-usersource.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian Post Sitesources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-post-sitesources.md
Title: "Create custodian siteSource"
-description: "Create a new custodian siteSource object."
+description: "Create a new custodian siteSource object associated with an eDiscovery custodian."
ms.localizationpriority: medium ms.prod: "ediscovery" doc_type: apiPageType
-# Create custodian siteSource
+# Create siteSource
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new [siteSource](../resources/security-sitesource.md) object.
+Create a new [siteSource](../resources/security-sitesource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}
## Request body In the request body, supply a JSON representation of the [siteSource](../resources/security-sitesource.md) object.
-You can specify the following properties when creating a **siteSource**.
+You can specify the following properties when you create a **siteSource**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating a **siteSource**.
## Response
-If successful, this method returns a `201 Created` response code and a [siteSource](../resources/security-sitesource.md) object in the response body.
+If successful, this method returns a `201 Created` response code and a [microsoft.graph.security.siteSource](../resources/security-sitesource.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian Post Unifiedgroupsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-post-unifiedgroupsources.md
Title: "Create custodian unifiedGroupSource"
-description: "Create a new custodian unifiedGroupSource object."
+description: "Create a new custodian unifiedGroupSource object associated with an eDiscovery custodian."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object.
+Create a new [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}
## Request body In the request body, supply a JSON representation of the [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object.
-You can specify the following properties when creating an **unifiedGroupSource**.
+You can specify the following properties when you create an **unifiedGroupSource**.
>**Note:** Either **group** or **group@odata.bind** is required in order to create a **unifiedGroupSource**. |Property|Type|Description| |:|:|:|
-|includedSources|microsoft.graph.ediscovery.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
|group|String|Specifies the email address for the group. To get the email address of a group, use [List groups](../api/group-list.md) or [Get group](../api/group-get.md). You can then query by the name of the group using `$filter`; for example, `https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'secret group'&$select=mail,id,displayName`.| |group@odata.bind|String|ID of the group. You can get this in the same way that you get the group. | ## Response
-If successful, this method returns a `201 Created` response code and an [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) object in the response body.
## Examples
The following is an example of a request.
} --> ``` http
-POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/custodian/unifiedGroupSources
+POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/unifiedGroupSources
Content-Type: application/json {
Content-Type: application/json
#### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
Content-Type: application/json
#### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian Post Usersources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-post-usersources.md
Title: "Create custodian userSource"
-description: "Create a new custodian userSource object."
+description: "Create a new custodian userSource object associated with an eDiscovery custodian."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new [userSource](../resources/security-usersource.md) object.
+Create a new [userSource](../resources/security-usersource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}
## Request body In the request body, supply a JSON representation of the [userSource](../resources/security-usersource.md) object.
-You can specify the following properties when creating a **userSource**.
+You can specify the following properties when you create a **userSource**.
|Property|Type|Description| |:|:|:| |email|String|SMTP address of the user.|
-|includedSources|String|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
## Response
-If successful, this method returns a `201 Created` response code and a [userSource](../resources/security-usersource.md) object in the response body.
+If successful, this method returns a `201 Created` response code and a [microsoft.graph.security.userSource](../resources/security-usersource.md) object in the response body.
## Examples
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverycustodian Release https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-release.md
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycustodian Removehold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-removehold.md
doc_type: apiPageType
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Start the process of removing hold from eDiscovery custodians. After the operation is created, you can get the status of the case operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [eDiscoveryHoldOpertaion](../resources/security-ediscoveryholdoperation.md).
+Start the process of removing hold from [eDiscovery custodians](../resources/security-ediscoverycustodian.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
The following table shows the parameters that can be used with this action.
If successful, this action returns a `202 Accepted` response code. ## Examples
-### Example 1. Apply hold to multiple custodians.
+### Example 1: Remove hold from multiple custodians
#### Request The following is an example of a request.
Content-Type: application/json
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
The following is an example of the response
HTTP/1.1 202 Accepted ```
-### Example 2. Apply hold to a single custodian.
+### Example 2: Remove hold from a single custodian
#### Request The following is an example of a request.
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverycustodian Updateindex https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverycustodian-updateindex.md
Title: "ediscoveryCustodian: updateIndex"
-description: "Triggers a indexOperation to make a custodian and associated sources searchable."
+description: "Trigger an indexOperation to make a custodian and associated sources searchable."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Triggers a [indexOperation](../resources/security-ediscoveryIndexOperation.md)
+Trigger an [indexOperation](../resources/security-ediscoveryIndexOperation.md)
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoveryexportoperation Getdownloadurl https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryexportoperation-getdownloadurl.md
One of the following permissions is required to call this API. To learn more, in
} --> ``` http
-GET /ediscoveryExportOperation/getDownloadUrl
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations/{eDiscoveryCaseOperationId}/microsoft.graph.security.ediscoveryExportOperation/getDownloadUrl
``` ## Request headers
The following is an example of a request.
} --> ``` http
-GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/operations/f98a9f54efeb479ab75164cd7d0a98fb/getDownloadUrl
+GET https://graph.microsoft.com/beta/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/operations/c5ae226f457547a582ef0eb6dbfaee25/microsoft.graph.security.ediscoveryExportOperation/getDownloadUrl
``` ### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryfile Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryfile-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryFile](../resources/security-ediscoveryfile.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryFile](../resources/security-ediscoveryfile.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryholdpolicy Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryholdpolicy-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryholdpolicy Post Sitesources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryholdpolicy-post-sitesources.md
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHo
## Request body In the request body, supply a JSON representation of the [siteSource](../resources/security-sitesource.md) object.
-You can specify the following properties when creating a **siteSource**.
+You can specify the following properties when you create a **siteSource**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating a **siteSource**.
## Response
-If successful, this method returns a `201 Created` response code and a [siteSource](../resources/security-sitesource.md) object in the response body.
+If successful, this method returns a `201 Created` response code and a [microsoft.graph.security.siteSource](../resources/security-sitesource.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryholdpolicy Post Usersources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryholdpolicy-post-usersources.md
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHo
## Request body In the request body, supply a JSON representation of the [userSource](../resources/security-usersource.md) object.
-You can specify the following properties when creating a **userSource**.
+You can specify the following properties when you create a **userSource**.
|Property|Type|Description| |:|:|:| |email|String|SMTP address of the user.|
-|includedSources|String|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
## Response
-If successful, this method returns a `201 Created` response code and a [userSource](../resources/security-usersource.md) object in the response body.
+If successful, this method returns a `201 Created` response code and a [microsoft.graph.security.userSource](../resources/security-usersource.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryholdpolicy Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryholdpolicy-update.md
PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryH
## Response
-If successful, this method returns a `204 No Content` response code and an updated [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object in the response body.
+If successful, this method returns a `204 No Content` response code and an updated [microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object in the response body.
## Examples
PATCH https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-4
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverynoncustodialdatasource Applyhold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverynoncustodialdatasource-applyhold.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Start the process of applying hold to eDiscovery non-custodial data sources. After the operation is created, you can get the status of the case operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [eDiscoveryHoldOpertaion](../resources/security-ediscoveryholdoperation.md).
+Start the process of applying hold on [eDiscovery non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
If successful, this action returns a `202 Accepted` response code.
## Examples
-### Example 1. Apply hold to multiple non-custodial data sources.
+### Example 1: Apply hold to multiple non-custodial data sources
#### Request The following is an example of a request.
Content-Type: application/json
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
The following is an example of the response
HTTP/1.1 202 Accepted ```
-### Example 2. Apply hold to a single non-custodial data source.
+### Example 2: Apply hold to a single non-custodial data source
#### Request The following is an example of a request.
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverynoncustodialdatasource Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverynoncustodialdatasource-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverynoncustodialdatasource Release https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverynoncustodialdatasource-release.md
Title: "ediscoveryNoncustodialDataSource: release"
-description: "Releases the non-custodial data source from the case."
+description: "Release the non-custodial data source from the case."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Releases the non-custodial data source from the case.
+Release the non-custodial data source from the case.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/{ediscovery
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverynoncustodialdatasource Removehold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverynoncustodialdatasource-removehold.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Start the process of removing hold from eDiscovery non-custodial data sources. After the operation is created, you can get the status of the case operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [eDiscoveryHoldOpertaion](../resources/security-ediscoveryholdoperation.md).
+Start the process of removing hold from [eDiscovery non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
If successful, this action returns a `202 Accepted` response code.
## Examples
-### Example 1. Remove hold from multiple non-custodial data sources.
+### Example 1: Remove hold from multiple non-custodial data sources
#### Request The following is an example of a request.
Content-Type: application/json
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
The following is an example of the response
HTTP/1.1 202 Accepted ```
-### Example 2. Remove hold from a single non-custodial data source.
+### Example 2: Remove hold from a single non-custodial data source
#### Request The following is an example of a request.
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
#### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverynoncustodialdatasource Updateindex https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverynoncustodialdatasource-updateindex.md
Title: "ediscoveryNoncustodialDataSource: updateIndex"
-description: "Triggers a indexOperation to make a non-custodial data source and its associated data source searchable."
+description: "Trigger an indexOperation to make a non-custodial data source and its associated data source searchable."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Triggers a [indexOperation](../resources/security-ediscoveryIndexOperation.md)
+Trigger an [indexOperation](../resources/security-ediscoveryIndexOperation.md)
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoveryreviewset Addtoreviewset https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-addtoreviewset.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Start the process of adding a collection from Microsoft 365 services to a review set. After the operation is created, you can get the status of the operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [Add to review set operation](../resources/security-ediscoveryaddtoreviewsetoperation.md).
+Start the process of adding a collection from Microsoft 365 services to a [review set](../resources/security-ediscoveryreviewset.md). After the operation is created, you can get the status of the operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [Add to review set operation](../resources/security-ediscoveryaddtoreviewsetoperation.md).
## Permissions
One of the following permissions is required to call this API. To learn more, in
} --> ``` http
-POST /ediscoveryExportOperation/reviewSet/addToReviewSet
+POST /security/cases/ediscoverycases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet
``` ## Request headers
The following is an example of a request.
} --> ``` http
-POST https://graph.microsoft.com/beta/ediscoveryExportOperation/reviewSet/addToReviewSet
+POST https://graph.microsoft.com/beta/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/addToReviewSet
Content-Type: application/json { "search": {
- "id": "7c165312-d8db-48b5-9129-1af50932df53"
+ "id": "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
}, "additionalDataOptions": "linkedFiles" }
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true } --> ``` http
-HTTP/1.1 204 No Content
+HTTP/1.1 202 Accepted
```
v1.0 Security Ediscoveryreviewset Delete Queries https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-delete-queries.md
Title: "Delete ediscoveryReviewSetQuery"
-description: "Deletes an ediscoveryReviewSetQuery object."
+description: "Delete an ediscoveryReviewSetQuery object."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Deletes an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
+Delete an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
One of the following permissions is required to call this API. To learn more, in
} --> ``` http
-DELETE /ediscoveryExportOperation/reviewSetQuery/$ref
+DELETE /security/cases/ediscoverycases/{eDiscoveryCaseId}}/reviewSets/{ediscoveryReviewSetId}/queries/{eDiscoveryReviewSetQueryId}
``` ## Request headers
The following is an example of a request.
} --> ``` http
-DELETE https://graph.microsoft.com/beta/ediscoveryExportOperation/reviewSetQuery
+DELETE https://graph.microsoft.com/beta/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/queries/b7f4961d-59b1-444f-a4ec-57f2e5c2bf21
``` ### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoveryreviewset Export https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-export.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Initiate an export from a **reviewSet**. For details, see [Export documents from a review set in Advanced eDiscovery](/microsoft-365/compliance/export-documents-from-review-set).
+Initiate an export from a **reviewSet**. For details, see [Export documents from a review set in eDiscovery (Premium)](/microsoft-365/compliance/export-documents-from-review-set).
## Permissions
The following table shows the parameters that can be used with this action.
|:|:|:| |outputName|String| Name of the export. Required. | |description|String| Description of the export |
-|azureBlobContainer|String| When exporting to your own Azure storage account, this is the container URL. |
-|azureBlobToken|String| When exporting to your own Azure storage account, SAS token for the container URL. |
+|azureBlobContainer|String| when you export to your own Azure storage account, this is the container URL. |
+|azureBlobToken|String| when you export to your own Azure storage account, SAS token for the container URL. |
|exportOptions|String|Specifies options that control the format of the export. Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.| |exportStructure|String| Options that control file structure and packaging of the export. Possible values are: `none`, `directory`, `pst`.| ## Response
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoveryreviewset Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewset List Files https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-list-files.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryFile](../resources/security-ediscoveryfile.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryFile](../resources/security-ediscoveryfile.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewset List Queries https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-list-queries.md
Title: "List ediscoveryReviewSetQuery"
-description: "Get the ediscoveryReviewSetQuery resources from the reviewSetQuery navigation property."
+ Title: "List queries"
+description: "Get the list of queries associated with an eDiscovery review set."
ms.localizationpriority: medium ms.prod: "ediscovery" doc_type: "apiPageType"
-# List ediscoveryReviewSetQuery
+# List queries
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the ediscoveryReviewSetQuery resources from the reviewSetQuery navigation property.
+Get the list of [queries](../resources/security-ediscoveryreviewsetquery.md) associated with an eDiscovery review set.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewset Post Queries https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewset-post-queries.md
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryRe
## Request body In the request body, supply a JSON representation of the [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
-You can specify the following properties when creating an **ediscoveryReviewSetQuery**.
+You can specify the following properties when you create an **ediscoveryReviewSetQuery**.
|Property|Type|Description| |:|:|:| |displayName|String|The name of the query. Required.|
-|contentQuery|String|The KQL query for the review set. [Learn more.](https://docs.microsoft.com/microsoft-365/compliance/review-set-search)|
+|contentQuery|String|The KQL query for the review set. For details, see [Query and filter content in a review set](/microsoft-365/compliance/review-set-search).|
## Response
-If successful, this method returns a `201 Created` response code and an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object in the response body.
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewsetquery Applytags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewsetquery-applytags.md
Title: "ediscoveryReviewSetQuery: applyTags"
-description: "Apply tags to files in eDiscovery review set."
+description: "Apply tags to files in an eDiscovery review set."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Apply tags to files in eDiscovery review set. [Learn more.](https://docs.microsoft.com/microsoft-365/compliance/tagging-documents)
+Apply tags to files in an [eDiscovery review set](../resources/security-ediscoveryreviewset.md). For details, see [Tag documents in a review set in eDiscovery](/microsoft-365/compliance/tagging-documents).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
The following is an example of a request.
} --> ``` http
-POST https://graph.microsoft.com/beta/ediscoveryExportOperation/reviewSetQuery/applyTags
+POST https://graph.microsoft.com/beta/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/queries/5f426fdc-f027-40db-b7cc-453cf06dc996/applyTags
Content-Type: application/json {
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoveryreviewsetquery Export https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewsetquery-export.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Initiate an export from a **reviewSet** query. For details, see [Export documents from a review set in Advanced eDiscovery](/microsoft-365/compliance/export-documents-from-review-set).
+Initiate an export from a **reviewSet** query. For details, see [Export documents from a review set in eDiscovery (Premium)](/microsoft-365/compliance/export-documents-from-review-set).
## Permissions
The following table shows the parameters that can be used with this action.
|:|:|:| |outputName|String| Name of the export. Required. | |description|String| Description of the export |
-|azureBlobContainer|String| When exporting to your own Azure storage account, this is the container URL. |
-|azureBlobToken|String| When exporting to your own Azure storage account, SAS token for the container URL. |
+|azureBlobContainer|String| when you export to your own Azure storage account, this is the container URL. |
+|azureBlobToken|String| when you export to your own Azure storage account, SAS token for the container URL. |
|exportOptions|String|Specifies options that control the format of the export. Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.| |exportStructure|String| Options that control file structure and packaging of the export. Possible values are: `none`, `directory`, `pst`.|
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoveryreviewsetquery Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewsetquery-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewsetquery Run https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewsetquery-run.md
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewsetquery Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewsetquery-update.md
PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryR
|Property|Type|Description| |:|:|:| |displayName|String|The name of the query. Required.|
-|contentQuery|String|The KQL query for the review set. [Learn more.](https://docs.microsoft.com/microsoft-365/compliance/review-set-search)|
+|contentQuery|String|The KQL query for the review set. For details, see [Query and filter content in a review set](/microsoft-365/compliance/review-set-search).|
The following is an example of a request.
} --> ``` http
-PATCH https://graph.microsoft.com/beta/ediscoveryExportOperation/reviewSetQuery
+PATCH https://graph.microsoft.com/beta/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/queries/5f426fdc-f027-40db-b7cc-453cf06dc996
Content-Type: application/json {
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
The following is an example of the response
--> ``` http HTTP/1.1 204 No content.
-```
+```
v1.0 Security Ediscoveryreviewtag Ashierarchy https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewtag-ashierarchy.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-List tags with the tag hierarchy shown.
+List [eDiscovery review tags](../resources/security-ediscoveryreviewtag.md) with the tag hierarchy shown.
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewtag Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewtag-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoveryreviewtag Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoveryreviewtag-update.md
PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewT
|:|:|:| |displayName|String|Display name of the tag. Required.| |description|String|Description of the tag. Optional.|
-|childSelectability|childSelectability|This value controls whether the UX presents the tags as checkboxes or a radio button group. The possible values are: `One`, `Many`. Required.|
+|childSelectability|microsoft.graph.security.childSelectability|This value controls whether the UX presents the tags as checkboxes or a radio button group. The possible values are: `One`, `Many`. Required.|
## Response
PATCH https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-c
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Delete Custodiansources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-delete-custodiansources.md
DELETE https://graph.microsoft.com/beta/security/cases/ediscoveryCases/{ediscove
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Delete Noncustodialsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-delete-noncustodialsources.md
DELETE https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Estimatestatistics https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-estimatestatistics.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Run an estimate of the number of emails and documents in the eDiscovery search. To learn more about searches in eDiscovery, see [Collect data for a case in Advanced eDiscovery](/microsoft-365/compliance/collecting-data-for-ediscovery).
+Run an estimate of the number of emails and documents in the eDiscovery search. To learn more about searches in eDiscovery, see [Collect data for a case in eDiscovery (Premium)](/microsoft-365/compliance/collecting-data-for-ediscovery).
## Permissions
Do not supply a request body for this method.
## Response If the estimate is started successfully, this action returns a `202 Accepted` response code.
-The response will also contain a `Location` header, which contains the location of the [estimateStatisticsOperation](../resources/security-ediscoveryestimateoperation.md) that was created to handle the estimate. Check the status of the estimate operation by making a GET request to the location, when successfully completed, the [status](../resources/ediscovery-caseoperation.md#caseoperationstatus-values) will change to `succeeded`.
+The response will also contain a `Location` header, which contains the location of the [microsoft.graph.security.estimateStatisticsOperation](../resources/security-ediscoveryestimateoperation.md) that was created to handle the estimate. Check the status of the estimate operation by making a GET request to the location.
## Examples
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-get.md
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and an [ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/58399dff-ceb
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverysearch List Additionalsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-list-additionalsources.md
Title: "List additionalSources"
-description: "Get the ediscoveryNoncustodialDataSource resources from the additionalSources navigation property."
+description: "Get the list of additional sources associated with an eDiscovery search."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the ediscovery data source resources from the additionalSources navigation property.
+Get the list of [additional sources](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.dataSource](../resources/security-datasource.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverysearch List Custodiansources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-list-custodiansources.md
Title: "List custodianSources"
-description: "Get the dataSource resources from the custodianSources navigation property."
+description: "Get the list of custodial data sources associated with an eDiscovery search."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the dataSource resources from the custodianSources navigation property.
+Get the list of custodial data sources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [dataSource](../resources/security-datasource.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.dataSource](../resources/security-datasource.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverysearch List Lastestimatestatisticsoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-list-lastestimatestatisticsoperation.md
Title: "List ediscoveryEstimateOperations"
+ Title: "List lastEstimateStatisticsOperation"
description: "Get the last ediscoveryEstimateOperation object and its properties." ms.localizationpriority: medium
ms.prod: "ediscovery"
doc_type: "apiPageType"
-# List ediscoveryEstimateOperations
+# List lastEstimateStatisticsOperation
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the last [ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) objects and their properties.
+Get the last [ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) objects and their properties.
>**Note:** This method only lists the last operation; it does not return a history of all operations.
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a [microsoft.graph.security.ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) object in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverysearch List Noncustodialsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-list-noncustodialsources.md
Title: "List noncustodialSources"
-description: "Get the ediscoveryNoncustodialDataSource resources from the noncustodialSources navigation property."
+description: "Get the list of noncustodialSources associated with an eDiscovery search."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Get the ediscoveryNoncustodialDataSource resources from the noncustodialSources navigation property.
+
+Get the list of noncustodialSources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
Do not supply a request body for this method.
## Response
-If successful, this method returns a `200 OK` response code and a collection of [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) objects in the response body.
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) objects in the response body.
## Examples
GET https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-418
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
v1.0 Security Ediscoverysearch Post Additionalsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-post-additionalsources.md
Title: "Create dataSource"
-description: "Create a new dataSource object."
+ Title: "Add additional sources"
+description: "Create a new additional source associated with an eDiscovery search."
ms.localizationpriority: medium ms.prod: "ediscovery" doc_type: "apiPageType"
-# Create dataSource
+# Add additional sources
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Create a new dataSource object.
+Create a new [additional source](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySear
## Request body In the request body, supply a JSON representation of the [dataSource](../resources/security-datasource.md) object.
-You can specify the following properties when creating a **dataSource**.
+You can specify the following properties when you create a **dataSource**.
->**Note:** Either **email** or **site** are required, not both.
+>**Note:** Either **email** or **site** is required, but not both.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating a **dataSource**.
## Response
-If successful, this method returns a `201 Created`.
+If successful, this method returns a `201 Created` and a [microsoft.graph.security.dataSource](../resources/security-datasource.md) object in the response body.
## Examples
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/{ediscovery
{ "@odata.type": "microsoft.graph.security.siteSource", "site": {
- "webUrl": "https://contoso.sharepoint.com/sites/SecretSite"
+ "webUrl": "https://m365x809305.sharepoint.com/sites/Design-topsecret"
} } ```
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/{ediscovery
### Response
-The following is an example of the response
+The following is an example of the response.
>**Note:** The response object shown here might be shortened for readability. <!-- { "blockType": "response",
The following is an example of the response
HTTP/1.1 201 Created {
- "@odata.context": "https://graph.microsoft.com/beta/$metadata#compliance/ediscovery/cases('15d80234-8320-4f10-96d0-d98d53ffdfc9')/sourceCollections('39b0bafd920e4360995c62e18a5e8a49')/additionalSources/$entity",
- "@odata.type": "#microsoft.graph.ediscovery.siteSource",
- "displayName": "Secret Site",
- "createdDateTime": "2021-08-11T23:35:02.33986Z",
- "id": "42393244-3838-4636-3437-453030334136",
+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/searches('c61a5860-d634-4d14-aea7-d82b6f4eb7af')/additionalSources/$entity",
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/46303732-3434-4630-3832-363333363441",
+ "displayName": "Design - top secret",
+ "createdDateTime": "2022-07-15T22:45:36.1096267Z",
+ "holdStatus": "0",
+ "id": "46303732-3434-4630-3832-363333363441",
"createdBy": {
+ "application": null,
"user": {
- "id": "798d8d23-2087-4e03-912e-c0d9db5cb5d2",
- "displayName": "Edisco Admin",
- "userPrincipalname": "ediscoadmin@contoso.com"
+ "id": null,
+ "displayName": null
} } }
v1.0 Security Ediscoverysearch Post Custodiansources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-post-custodiansources.md
Title: "Add dataSource"
-description: "Add custodianSources by posting to the custodianSources collection."
+ Title: "Add custodian sources"
+description: "Create a new custodian source associated with an eDiscovery search.."
ms.localizationpriority: medium ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Add dataSource
+# Add custodian sources
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Add custodianSources by posting to the custodianSources collection.
+Create a new custodian source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySear
## Request body In the request body, supply a JSON representation of the [dataSource](../resources/security-datasource.md) object.
-You can specify the following properties when creating a **dataSource**.
+You can specify the following properties when you create a **dataSource**.
|Property|Type|Description| |:|:|:|
-|@odata.id|String|String that defines the custodial object. See the example that follows.|
+|@odata.id|String|String that defines the custodial object. See [the example](#examples) that follows.|
## Response
-If successful, this method returns a `204 No Content` response code and a [dataSource](../resources/security-datasource.md) object in the response body.
+If successful, this method returns a `204 No Content` response code.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Post Noncustodialsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-post-noncustodialsources.md
Title: "Add ediscoveryNoncustodialDataSource"
-description: "Add noncustodialSources by posting to the noncustodialSources collection."
+ Title: "Add noncustodialDataSources"
+description: "Create a new non-custodial source associated with an eDiscovery search."
ms.localizationpriority: medium ms.prod: "ediscovery"
doc_type: "apiPageType"
-# Add ediscoveryNoncustodialDataSource
+# Add Add noncustodialDataSources
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Add noncustodialSources by posting to the noncustodialSources collection.
+Create a new non-custodial source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySear
## Request body In the request body, supply a JSON representation of the [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
-You can specify the following properties when creating an **ediscoveryNoncustodialDataSource**.
+You can specify the following properties when you create an **ediscoveryNoncustodialDataSource**.
|Property|Type|Description| |:|:|:|
You can specify the following properties when creating an **ediscoveryNoncustodi
## Response
-If successful, this method returns a `204 No Content` response code and an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
+If successful, this method returns a `204 No Content` response code.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Purgedata https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-purgedata.md
You can collect and purge the following categories of Teams content:
For more information about purging Teams messages, see: - [eDiscovery solution series: Data spillage scenario - Search and purge](/microsoft-365/compliance/data-spillage-scenariosearch-and-purge)-- [Advanced eDiscovery workflow for content in Microsoft Teams](/microsoft-365/compliance/teams-workflow-in-advanced-ediscovery)
+- [eDiscovery (Premium) workflow for content in Microsoft Teams](/microsoft-365/compliance/teams-workflow-in-advanced-ediscovery)
## Permissions
POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-41
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
<!-- { "blockType": "response", "truncated": true
v1.0 Security Ediscoverysearch Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/api/security-ediscoverysearch-update.md
PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySea
|Property|Type|Description| |:|:|:| |contentQuery|String|The query string in KQL (Keyword Query Language) query. For details, see [Keyword queries and search conditions for Content Search and eDiscovery](/microsoft-365/compliance/keyword-queries-and-search-conditions). You can refine searches by using fields paired with values; for example, `subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016`.|
-|dataSourceScopes|dataSourceScopes|When specified, the collection will span across a service for an entire workload. Possible values are: `none`,`allTenantMailboxes`,`allTenantSites`,`allCaseCustodians`,`allCaseNoncustodialDataSources`. **Note:** Either one custodian or specifying dataSourceScope is required when creating a source collection.|
+|dataSourceScopes|microsoft.graph.security.dataSourceScopes|When specified, the collection will span across a service for an entire workload. Possible values are: `none`,`allTenantMailboxes`,`allTenantSites`,`allCaseCustodians`,`allCaseNoncustodialDataSources`. **Note:** Either one custodian or specifying dataSourceScope is required when you create a source collection.|
|description|String|The description of the **eDiscovery search**.| |displayName|String|The display name of the **eDiscovery search**.| ## Response
-If successful, this method returns a `204 No Content` response code and an updated [ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
+If successful, this method returns a `204 No Content` response code and an updated [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
## Examples
Content-Type: application/json
### Response
-The following is an example of the response
->**Note:** The response object shown here might be shortened for readability.
+The following is an example of the response.
+ <!-- { "blockType": "response", "truncated": true
v1.0 Security Api Overview https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-api-overview.md
The following are some of the most popular requests for working with the Microso
|List simulations|[List simulations](../api/attacksimulationroot-list-simulations.md)|[https://graph.microsoft.com/beta/security/attackSimulation/simulations](https://developer.microsoft.com/graph/graph-explorer?request=security/attackSimulation/simulations&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)| |Get simulation overview report|[Get simulation overview report](../api/simulationreportoverview-get.md)|[https://graph.microsoft.com/beta/security/attackSimulation/simulations/{id}/report/overview](https://developer.microsoft.com/graph/graph-explorer?request=security/attackSimulation/simulations/{id}/report/overview&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)| |List simulation users report|[List simulation users report](../api/usersimulationdetails-list.md)|[https://graph.microsoft.com/beta/security/attackSimulation/simulations/{id}/report/simulationUsers](https://developer.microsoft.com/graph/graph-explorer?request=security/attackSimulation/simulations/{id}/report/simulationUsers&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)|
+| **eDiscovery**|||
+|List eDiscovery cases|[List eDiscoveryCases](../api/security-casesroot-list-ediscoverycases.md)|[https://graph.microsoft.com/beta/security/cases/eDiscoveryCases](https://developer.microsoft.com/graph/graph-explorer?request=security%2Fcases%2FeDiscoverycases&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)|
+|List eDiscovery case operations|[List caseOperations](../api/security-ediscoverycase-list-operations.md)|[https://graph.microsoft.com/beta/security/cases/eDiscoverycases/{id}/operations](https://developer.microsoft.com/graph/graph-explorer?request=security%2Fcases%2FeDiscoverycases%2F%7Bid%7D%2Foperations&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)|
| **Secure scores**||| |List secure scores|[List secureScores](../api/securescores-list.md)|[https://graph.microsoft.com/beta/security/secureScores](https://developer.microsoft.com/graph/graph-explorer?request=security/secureScores&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)| | **Secure score control profiles**|||
v1.0 Security Datasource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-datasource.md
None.
|createdDateTime|DateTimeOffset|The date and time the **dataSource** was created.| |displayName|String|The display name of the **dataSource**. This will be the name of the SharePoint site.| |id|String| The ID of the **dataSource**. This is not the ID of the actual site.|
-|holdStatus|String|The hold status of the **dataSource**.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **dataSource**.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
## Relationships None.
v1.0 Security Datasourcecontainer https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-datasourcecontainer.md
None.
## Properties |Property|Type|Description| |:|:|:|
-|holdStatus|String|The hold status of the dataSourceContainer.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the dataSourceContainer.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
|createdDateTime|DateTimeOffset|Created date and time of the dataSourceContainer entity.| |displayName|String|Display name of the dataSourceContainer entity.| |id|String|Unique identifier of the dataSourceContainer. Inherited from [entity](../resources/entity.md)| |lastModifiedDateTime|DateTimeOffset|Last modified date and time of the dataSourceContainer.| |releasedDateTime|DateTimeOffset|Date and time that the dataSourceContainer was released from the case.|
-|status|String|Latest status of the dataSourceContainer. Possible values are: `Active`, `Released`.|
+|status|microsoft.graph.security.dataSourceContainerStatus|Latest status of the dataSourceContainer. Possible values are: `Active`, `Released`.|
++
+### dataSourceContainerStatus values
+
+|Member|Description|
+|:-|--|
+| active| Data source container is active.|
+| release | Data source container has been released.|
+
+### dataSourceHoldStatus values
+
+|Member|Description|
+|:-|--|
+| notApplied | Data source container is not on hold.|
+| applied | Data source container is on hold.|
+| applying | Data source container is in applying hold state (applyHold operation triggered).|
+| removing | Data source container is in removing the hold state (removeHold operation triggered).|
+| partial | Data source container is in mixed state where some sources are on hold and some not on hold or error state.|
+ ## Relationships None.
v1.0 Security Ediscoveryaddtoreviewsetoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryaddtoreviewsetoperation.md
None.
## Properties |Property|Type|Description| |:|:|:|
-|action|String| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|action|microsoft.graph.security.caseAction| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
|completedDateTime|DateTimeOffset| The date and time the operation was completed. | |createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. | |createdDateTime|DateTimeOffset| The date and time the operation was created. | |id|String| The ID for the operation. Read-only. | |percentProgress|Int32| The progress of the operation. | |resultInfo|[resultInfo](../resources/resultinfo.md)| Contains success and failure-specific result information. |
-|status|String| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+|status|microsoft.graph.security.caseOperationStatus| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
## Relationships |Relationship|Type|Description|
v1.0 Security Ediscoverycase https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoverycase.md
In the context of eDiscovery, contains custodians, holds, searches, review sets,
|[Create ediscoveryCase](../api/security-casesroot-post-ediscoverycases.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md)|Create a new [ediscoveryCase](../resources/security-ediscoverycase.md) object.| |[Get ediscoveryCase](../api/security-ediscoverycase-get.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md)|Read the properties and relationships of an [ediscoveryCase](../resources/security-ediscoverycase.md) object.| |[Update ediscoveryCase](../api/security-ediscoverycase-update.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md)|Update the properties of an [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
-|[Delete ediscoveryCase](../api/security-casesroot-delete-ediscoverycases.md)|None|Deletes an [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
+|[Delete ediscoveryCase](../api/security-casesroot-delete-ediscoverycases.md)|None|Delete an [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
|[List custodians](../api/security-ediscoverycase-list-custodians.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) collection|Get the ediscoveryCustodian resources from the custodians navigation property.| |[Create ediscoveryCustodian](../api/security-ediscoverycase-post-custodians.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md)|Create a new ediscoveryCustodian object.| |[List legalHolds](../api/security-ediscoverycase-list-legalholds.md)|[microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) collection|Get the ediscoveryHoldPolicy resources from the legalHolds navigation property.|
In the context of eDiscovery, contains custodians, holds, searches, review sets,
|id|String|The ID for the eDiscovery case. Read-only. | |lastModifiedBy|[microsoft.graph.identitySet](../resources/identityset.md)|The last user who modified the case. |lastModifiedDateTime|DateTimeOffset|The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
-|status|String|The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.
+|status|microsoft.graph.security.caseStatus|The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.
### caseStatus values
v1.0 Security Ediscoverycasesettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoverycasesettings.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Contains settings for an eDiscovery case. For details, see [Configure search and analytics settings in Advanced eDiscovery](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery).
+Contains settings for an eDiscovery case. For details, see [Configure search and analytics settings in eDiscovery (Premium)](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery).
Inherits from [entity](../resources/entity.md).
v1.0 Security Ediscoverycustodian https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoverycustodian.md
In the context of eDiscovery, represents a user and all of their digital assets,
|[release](../api/security-ediscoverycustodian-release.md)|None|Release a custodian from a case.| |[applyHold](../api/security-ediscoverycustodian-applyhold.md)|None|Start the process of applying hold to eDiscovery custodians.| |[removeHold](../api/security-ediscoverycustodian-removehold.md)|None|Start the process of removing hold from eDiscovery custodians.|
-|[List ediscoveryIndexOperation](../api/security-ediscoverycustodian-list-lastindexoperation.md)|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) collection|Get the ediscoveryIndexOperation resources from the lastIndexOperation navigation property.|
+|[List ediscoveryIndexOperation](../api/security-ediscoverycustodian-list-lastindexoperation.md)|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) collection|Get a list of the [ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).|
|[List siteSources](../api/security-ediscoverycustodian-list-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|Get the siteSource resources from the siteSources navigation property.|
-|[Create siteSource](../api/security-ediscoverycustodian-post-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md)|Create a new siteSource object.|
+|[Create siteSource](../api/security-ediscoverycustodian-post-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md)|Create a new [siteSource](../resources/security-sitesource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).|
|[List unifiedGroupSources](../api/security-ediscoverycustodian-list-unifiedgroupsources.md)|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) collection|Get the unifiedGroupSource resources from the unifiedGroupSources navigation property.|
-|[Create unifiedGroupSource](../api/security-ediscoverycustodian-post-unifiedgroupsources.md)|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md)|Create a new unifiedGroupSource object.|
+|[Create unifiedGroupSource](../api/security-ediscoverycustodian-post-unifiedgroupsources.md)|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md)|Create a new [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).|
|[List userSources](../api/security-ediscoverycustodian-list-usersources.md)|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Get the userSource resources from the userSources navigation property.|
-|[Create userSource](../api/security-ediscoverycustodian-post-usersources.md)|[microsoft.graph.security.userSource](../resources/security-usersource.md)|Create a new userSource object.|
+|[Create userSource](../api/security-ediscoverycustodian-post-usersources.md)|[microsoft.graph.security.userSource](../resources/security-usersource.md)|Create a new [userSource](../resources/security-usersource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).|
## Properties |Property|Type|Description|
In the context of eDiscovery, represents a user and all of their digital assets,
|id|String|The ID for the custodian in the specified case. Read-only.| |lastModifiedDateTime|DateTimeOffset|Date and time the custodian object was last modified| |releasedDateTime|DateTimeOffset|Date and time the custodian was released from the case.|
-|status|microsoft.graph.ediscovery.custodianStatus|Status of the custodian. Possible values are: `active`, `released`.|
-|holdStatus|String|The hold status of the custodian.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|status|microsoft.graph.security.dataSourceContainerStatus|Status of the custodian. Possible values are: `active`, `released`.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the custodian.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
### custodianStatus values
In the context of eDiscovery, represents a user and all of their digital assets,
|lastIndexOperation|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md)|Operation entity that represents the latest indexing for the custodian.| |siteSources|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|Data source entity for SharePoint sites associated with the custodian.| |unifiedGroupSources|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) collection|Data source entity for groups associated with the custodian.|
-|userSources|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Data source entity for a the custodian. This is the container for a custodian's mailbox and OneDrive for Business site.|
+|userSources|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Data source entity for a custodian. This is the container for a custodian's mailbox and OneDrive for Business site.|
## JSON representation The following is a JSON representation of the resource.
v1.0 Security Ediscoveryestimateoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryestimateoperation.md
None.
## Properties |Property|Type|Description| |:|:|:|
-|action|String| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|action|microsoft.graph.security.caseAction| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
|completedDateTime|DateTimeOffset|The date and time the operation was completed. Read-only. | |createdBy|[identitySet](../resources/identityset.md)|The user who created the operation. Read-only. | |createdDateTime|DateTimeOffset|The date and time the operation was started. Read-only.|
None.
|percentProgress|Int32|The progress of the operation. Read-only. | |resultInfo|[resultInfo](../resources/resultinfo.md)|Contains success and failure-specific result information. | |siteCount|Int32|The number of mailboxes that had search hits.|
-|status|String| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+|status|microsoft.graph.security.caseOperationStatus| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
|unindexedItemCount|Int64|The estimated count of unindexed items for the collection.| |unindexedItemsSize|Int64|The estimated size of unindexed items for the collection.|
v1.0 Security Ediscoveryexportoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryexportoperation.md
Inherits from [caseOperation](../resources/security-caseoperation.md).
|createdBy|[identitySet](../resources/identityset.md)| The user who initiated the export operation.| |createdDateTime|DateTimeOffset| The date and time the export was created.| |description|String| The description provided for the export.|
-|exportOptions|microsoft.graph.ediscovery.exportOptions| The options provided for the export. For more details, see [reviewSet: export](../api/security-ediscoveryreviewset-export.md). Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.|
-|exportStructure|microsoft.graph.ediscovery.exportFileStructure|The options provided that specify the structure of the export. For more details, see [reviewSet: export](../api/security-ediscoveryreviewset-export.md). Possible values are: `none`, `directory`, `pst`.|
+|exportOptions|microsoft.graph.security.exportOptions| The options provided for the export. For more details, see [reviewSet: export](../api/security-ediscoveryreviewset-export.md). Possible values are: `originalFiles`, `text`, `pdfReplacement`, `fileInfo`, `tags`.|
+|exportStructure|microsoft.graph.security.exportFileStructure|The options provided that specify the structure of the export. For more details, see [reviewSet: export](../api/security-ediscoveryreviewset-export.md). Possible values are: `none`, `directory`, `pst`.|
|id|String| The ID for the operation. Read-only. | |outputName|String| The name provided for the export.| |percentProgress|Int32| The progress of the operation.| |resultInfo|[resultInfo](../resources/resultinfo.md)|Contains success and failure-specific result information. Inherited from [caseOperation](../resources/ediscovery-caseoperation.md).| |status|[microsoft.graph.security.caseOperationStatus](../resources/security-caseoperation.md#caseoperationstatus-values)| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+### exportOptions values
+
+|Member|Description|
+|:-|--|
+|originalFiles|Include original files in native format. For example: docx, xlsx, pptx, doc, xlst, pptm, etc.|
+|text|Include extracted text from the original files.|
+|pdfReplacement|Replace original file with PDF version when available.|
+|fileInfo|Include metadata of original files in a load file.|
+|tags|Include tag information in fileInfo.|
+
+### exportFileStructure values
+
+|Member|Description|
+|:-|--|
+|None|Default file structure.|
+|directory|All files in a singe folder called NativeFiles.|
+|pst|Mails will be grouped in pst format.|
+ ## Relationships |Relationship|Type|Description| |:|:|:|
v1.0 Security Ediscoveryfile https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryfile.md
Entity that represents ediscovery ReviewSet files.
|id|String|The unique identifier for the file.| |mediaType|String|mimeType of the file. Eg: text/plain, charset=UTF-8, application/vnd.ms-outlook.| |name|String|The name of the file. Subject of the mail in case of email.|
-|otherProperties|String|A list of additional properties of the file like titleOfSharepointDocument, emailRecipients. [Learn more](https://docs.microsoft.com/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery).|
-|processingStatus|String|The processing status after the item was added to a review set. The possible values are: `success`, `internalError`, `unknownError`, `processingTimeout`, `invalidFileId`, `fileSizeIsZero`, `fileSizeIsTooLarge`, `fileDepthLimitExceeded`, `fileBodyIsTooLong`, `fileTypeIsUnknown`, `fileTypeIsNotSupported`, `malformedFile`, `protectedFile`, `poisonFile`, `noReviewSetSummaryGenerated`, `extractionException`, `ocrProcessingTimeout`, `ocrFileSizeExceedsLimit`.|
+|otherProperties|microsoft.graph.security.stringValueDictionary|A list of additional properties of the file like titleOfSharepointDocument, emailRecipients. [Learn more](https://docs.microsoft.com/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery).|
+|processingStatus|microsoft.graph.security.fileProcessingStatus|The processing status after the item was added to a review set. The possible values are: `success`, `internalError`, `unknownError`, `processingTimeout`, `invalidFileId`, `fileSizeIsZero`, `fileSizeIsTooLarge`, `fileDepthLimitExceeded`, `fileBodyIsTooLong`, `fileTypeIsUnknown`, `fileTypeIsNotSupported`, `malformedFile`, `protectedFile`, `poisonFile`, `noReviewSetSummaryGenerated`, `extractionException`, `ocrProcessingTimeout`, `ocrFileSizeExceedsLimit`.|
|senderAuthor|String collection|The sender of the email or authors of the document.| |size|Int64|size of the file.|
-|sourceType|String|The original source of the content. The possible values are: `mailbox`, `site`.|
+|sourceType|microsoft.graph.security.sourceType|The original source of the content. The possible values are: `mailbox`, `site`.|
|subjectTitle|String|The subject of the email or title of the document|
+### fileProcessingStatus values
+
+|Member|Description|
+|:-|--|
+|success| File was successfully processed.|
+|internalError| Unhandled exception occurred during processing the file.|
+|unknownError|status of processing is null or empty.|
+|processingTimeout|Timeout occurred during processing.|
+|invalidFileId|Failed to create a unique field id has for the file.|
+|fileSizeIsZero|File size is zero or negative.|
+|fileSizeIsTooLarge|File size exceeds the limits for processing.|
+|fileDepthLimitExceeded|File depth exceeded the processing limit (30).|
+|fileBodyIsTooLong|The length of texts in the document exceeds the processing limit.|
+|fileTypeIsUnknown| MimeType not supported.|
+|fileTypeIsNotSupported| File format not supported.|
+|malformedFile|File is malformed.|
+|protectedFile|An email is rights protected or a document is encrypted.|
+|poisonFile|File already processed.|
+|noReviewSetSummaryGenerated|Generation of review set summary failed.|
+|extractionException|Extraction of embedded documents failed.|
+|ocrProcessingTimeout|Timeout while ocrProcessing of the file.|
+|ocrFileSizeExceedsLimit|File size exceeds the limits for OCR processing.|
++ ### dateTime values |File type|Definition| |:|:|
v1.0 Security Ediscoveryholdoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryholdoperation.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Represents the process of applying hold to data sources, including custodians and non-custodial data sources."
+Represents the process of applying hold to data sources, including custodians and non-custodial data sources.
Inherits from [caseOperation](../resources/security-caseoperation.md).
v1.0 Security Ediscoveryholdpolicy https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryholdpolicy.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Represents a legal hold policy. Legal holds are holds that are tied to an eDiscovery case. Legal holds should not be confused with retention holds, which are used to control retention policies for Microsoft 365 content. eDiscovery legal holds are for holding content indefinitely for litigation, internal investigations, and other legal actions where content needs to be protected against deletion. For more information, see [Manage holds in Advanced eDiscovery](/microsoft-365/compliance/managing-holds)
+Represents a legal hold policy. Legal holds are holds that are tied to an eDiscovery case. Legal holds should not be confused with retention holds, which are used to control retention policies for Microsoft 365 content. eDiscovery legal holds are for holding content indefinitely for litigation, internal investigations, and other legal actions where content needs to be protected against deletion. For more information, see [Manage holds in eDiscovery (Premium)](/microsoft-365/compliance/managing-holds)
## Methods |Method|Return type|Description|
Represents a legal hold policy. Legal holds are holds that are tied to an eDisco
|[Create ediscoveryHoldPolicy](../api/security-ediscoverycase-post-legalholds.md)|[microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md)|Create a new [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.| |[Get ediscoveryHoldPolicy](../api/security-ediscoveryholdpolicy-get.md)|[microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md)|Read the properties and relationships of an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.| |[Update ediscoveryHoldPolicy](../api/security-ediscoveryholdpolicy-update.md)|[microsoft.graph.security.ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md)|Update the properties of an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.|
-|[Delete ediscoveryHoldPolicy](../api/security-ediscoverycase-delete-legalholds.md)|None|Deletes an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.|
+|[Delete ediscoveryHoldPolicy](../api/security-ediscoverycase-delete-legalholds.md)|None|Delete an [ediscoveryHoldPolicy](../resources/security-ediscoveryholdpolicy.md) object.|
|[List siteSources](../api/security-ediscoverycustodian-list-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|Get the siteSource resources from the siteSources navigation property.| |[Create siteSource](../api/security-ediscoveryholdpolicy-post-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md)|Create a new siteSource object.| |[List userSources](../api/security-ediscoverycustodian-list-usersources.md)|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Get the userSource resources from the userSources navigation property.|
Represents a legal hold policy. Legal holds are holds that are tied to an eDisco
|isEnabled|Boolean|Indicates whether the hold is enabled and actively holding content. | |lastModifiedBy|[identitySet](../resources/identityset.md)|the user who last modified the legal hold.| |lastModifiedDateTime|DateTimeOffset|The date and time the legal hold was last modified. |
-|status|String|The status of the legal hold. Possible values are: `Pending`, `Error`, `Success`.|
+|status|microsoft.graph.security.policyStatus|The status of the legal hold. Possible values are: `Pending`, `Error`, `Success`.|
-### legalHoldStatus values
+### policyStatus values
|Member|Description| |:|--|
Represents a legal hold policy. Legal holds are holds that are tied to an eDisco
## Relationships |Relationship|Type|Description| |:|:|:|
-|siteSources|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|**TODO: Add Description**|
-|userSources|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|**TODO: Add Description**|
+|siteSources|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|Data sources that represent SharePoint sites.|
+|userSources|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Data sources that represent Exchange mailboxes.|
## JSON representation The following is a JSON representation of the resource.
v1.0 Security Ediscoveryindexoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryindexoperation.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Represents the process of indexing data sources, including custodians and non-custodial data sources."
+Represents the process of indexing data sources, including custodians and non-custodial data sources.
Inherits from [caseOperation](../resources/security-caseoperation.md).
v1.0 Security Ediscoverynoncustodialdatasource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoverynoncustodialdatasource.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Non-custodial data sources let you add data to a case without having to associate it to a custodian. To learn more, visit [Add non-custodial data sources to an Advanced eDiscovery case
-](/microsoft-365/compliance/non-custodial-data-sources)
-
+Enables the addition of data to an eDiscovery case without associating it with a custodian. For details, see [Add non-custodial data sources to an eDiscovery (Premium) case](/microsoft-365/compliance/non-custodial-data-sources).
Inherits from [dataSourceContainer](../resources/security-datasourcecontainer.md).
Inherits from [dataSourceContainer](../resources/security-datasourcecontainer.md
|[release](../api/security-ediscoverynoncustodialdatasource-release.md)|None|Release a non-custodial data source from a case.| |[applyHold](../api/security-ediscoverynoncustodialdatasource-applyhold.md)|None|Start the process of applying hold to eDiscovery non-custodial data sources.| |[removeHold](../api/security-ediscoverynoncustodialdatasource-removehold.md)|None|Start the process of removing hold from eDiscovery non-custodial data sources.|
-|[List ediscoveryIndexOperation](../api/security-ediscoverycustodian-list-lastindexoperation.md)|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) collection|Get the ediscoveryIndexOperation resources from the lastIndexOperation navigation property.|
+|[List ediscoveryIndexOperation](../api/security-ediscoverycustodian-list-lastindexoperation.md)|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) collection|Get a list of the [ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) associated with an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md).|
## Properties |Property|Type|Description| |:|:|:|
-|createdDateTime|DateTimeOffset|Created date and time of the nonCustodialDataSource. Inherited from [microsoft.graph.ediscovery.dataSourceContainer](../resources/ediscovery-datasourcecontainer.md).|
-|displayName|String|Display name of the noncustodialDataSource. Inherited from [microsoft.graph.ediscovery.dataSourceContainer](../resources/ediscovery-datasourcecontainer.md).|
+|createdDateTime|DateTimeOffset|Created date and time of the nonCustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|displayName|String|Display name of the noncustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
|id|String|Unique identifier of the nonCustodialDataSource. Inherited from [entity](../resources/entity.md).|
-|lastModifiedDateTime|DateTimeOffset|Last modified date and time of the nonCustodialDataSource. Inherited from [microsoft.graph.ediscovery.dataSourceContainer](../resources/ediscovery-datasourcecontainer.md).|
-|releasedDateTime|DateTimeOffset|Date and time that the nonCustodialDataSource was released from the case. Inherited from [microsoft.graph.ediscovery.dataSourceContainer](../resources/ediscovery-datasourcecontainer.md).|
-|status|String|Latest status of the nonCustodialDataSource. Inherited from [microsoft.graph.ediscovery.dataSourceContainer](../resources/ediscovery-datasourcecontainer.md). Possible values are: `Active`, `Released`.|
-|holdStatus|String|The hold status of the nonCustodialDataSource.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|lastModifiedDateTime|DateTimeOffset|Last modified date and time of the nonCustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|releasedDateTime|DateTimeOffset|Date and time that the nonCustodialDataSource was released from the case. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|status|microsoft.graph.security.dataSourceContainerStatus|Latest status of the nonCustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md). Possible values are: `Active`, `Released`.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the nonCustodialDataSource.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
## Relationships |Relationship|Type|Description|
v1.0 Security Ediscoveryreviewset https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryreviewset.md
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Represents static set of electronically stored information collected for use in a litigation, investigation, or regulatory request.
+Represents the static set of electronically stored information collected for use in a litigation, investigation, or regulatory request.
## Methods |Method|Return type|Description|
Represents static set of electronically stored information collected for use in
|[List ediscoveryReviewSets](../api/security-ediscoverycase-list-reviewsets.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) collection|Get a list of the [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects and their properties.| |[Create ediscoveryReviewSet](../api/security-ediscoverycase-post-reviewsets.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md)|Create a new [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.| |[Get ediscoveryReviewSet](../api/security-ediscoveryreviewset-get.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md)|Read the properties and relationships of an [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.|
-|[export](../api/security-ediscoveryreviewset-export.md)|None|Initiate an export of data from the **reviewset**.|
-|[addToReviewSet](../api/security-ediscoveryreviewset-addtoreviewset.md)|None|Add data from a **eDiscovery search** to a **reviewset**.|
+|[export](../api/security-ediscoveryreviewset-export.md)|None|Initiate an export of data from a [review set](../resources/security-ediscoveryreviewset.md).|
+|[addToReviewSet](../api/security-ediscoveryreviewset-addtoreviewset.md)|None|Start the process of adding a collection from Microsoft 365 services to a [review set](../resources/security-ediscoveryreviewset.md).|
|[List files](../api/security-ediscoveryreviewset-list-files.md)|[microsoft.graph.security.ediscoveryFile](../resources/security-ediscoveryfile.md) collection|Get the ediscoveryFile resources from the files navigation property.|
-|[List queries](../api/security-ediscoveryreviewset-list-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) collection|Get the ediscoveryReviewSetQuery resources from the queries navigation property.|
+|[List queries](../api/security-ediscoveryreviewset-list-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) collection|Get the list of [queries](../resources/security-ediscoveryreviewsetquery.md) associated with an eDiscovery review set.|
|[Create ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-post-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Create a new ediscoveryReviewSetQuery object.| ## Properties
v1.0 Security Ediscoveryreviewsetquery https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryreviewsetquery.md
Represents a review set query, which is used to query and cull data stored in an
|[Create ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-post-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Create a new [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.| |[Get ediscoveryReviewSetQuery](../api/security-ediscoveryreviewsetquery-get.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Read the properties and relationships of an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.| |[Update ediscoveryReviewSetQuery](../api/security-ediscoveryreviewsetquery-update.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Update the properties of an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
-|[Delete ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-delete-queries.md)|None|Deletes an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
+|[Delete ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-delete-queries.md)|None|Delete an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
|[export](../api/security-ediscoveryreviewsetquery-export.md)|None|Export documents that match the specified query from a review set.| |[applyTags](../api/security-ediscoveryreviewsetquery-applytags.md)|None|Apply tags to documents that match the specified query.| |[run](../api/security-ediscoveryreviewsetquery-run.md)|[microsoft.graph.security.ediscoveryFile](../resources/security-ediscoveryfile.md) collection|Get files from the query.|
Represents a review set query, which is used to query and cull data stored in an
| id |String| The unique identifier of the query. Read-only.| | lastModifiedBy | [identitySet](/graph/api/resources/identityset) | The user who last modified the query. | | lastModifiedDateTime |DateTimeOffset | The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
-| query | String | The query string in KQL (Keyword Query Language) query. For details, see [Document metadata fields in Advanced eDiscovery](/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery). This field maps directly to the keywords condition. You can refine searches by using fields listed in the *searchable field name* paired with values; for example, *subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016*. |
+| query | String | The query string in KQL (Keyword Query Language) query. For details, see [Document metadata fields in eDiscovery (Premium)](/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery). This field maps directly to the keywords condition. You can refine searches by using fields listed in the *searchable field name* paired with values; for example, *subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016*. |
## Relationships
v1.0 Security Ediscoveryreviewtag https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoveryreviewtag.md
Represents an eDiscovery tag, which is used to mark documents during review to s
|[Create ediscoveryReviewTag](../api/security-ediscoverycase-post-tags.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Create a new [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.| |[Get ediscoveryReviewTag](../api/security-ediscoveryreviewtag-get.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Read the properties and relationships of an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.| |[Update ediscoveryReviewTag](../api/security-ediscoveryreviewtag-update.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Update the properties of an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
-|[Delete ediscoveryReviewTag](../api/security-ediscoverycase-delete-tags.md)|None|Deletes an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
+|[Delete ediscoveryReviewTag](../api/security-ediscoverycase-delete-tags.md)|None|Delete an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
|[asHierarchy](../api/security-ediscoveryreviewtag-ashierarchy.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|List tags organized as hierarchy.| ## Properties |Property|Type|Description| |:|:|:|
-|childSelectability|String|Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.|
+|childSelectability|microsoft.graph.security.childSelectability|Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.|
|createdBy|[identitySet](../resources/identityset.md)|The user who created the tag.| |description|String|The description for the tag.| |displayName|String|Display name of the tag.|
v1.0 Security Ediscoverysearch https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoverysearch.md
Represents an eDiscovery search. For details, see [Collect data for a case in eD
|[Create ediscoverySearch](../api/security-ediscoverycase-post-searches.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Create a new [ediscoverySearch](../resources/security-ediscoverysearch.md) object.| |[Get ediscoverySearch](../api/security-ediscoverysearch-get.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Read the properties and relationships of an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.| |[Update ediscoverySearch](../api/security-ediscoverysearch-update.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Update the properties of an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
-|[Delete ediscoverySearch](../api/security-ediscoverycase-delete-searches.md)|None|Deletes an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
+|[Delete ediscoverySearch](../api/security-ediscoverycase-delete-searches.md)|None|Delete an [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
|[estimateStatistics](../api/security-ediscoverysearch-estimatestatistics.md)|None|Run an estimate statistics operation on the data contained in the eDiscovery search.| |[purgeData](../api/security-ediscoverysearch-purgedata.md)|None|Run a purge data operation on the Teams data contained in the eDiscovery search.|
-|[List additionalSources](../api/security-ediscoverysearch-list-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Get the dataSource resources from the additionalSources navigation property.|
-|[Create dataSource](../api/security-ediscoverysearch-post-additionalsources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Create a new dataSource object.|
-|[List ediscoveryEstimateOperation](../api/security-ediscoverysearch-list-lastestimatestatisticsoperation.md)|[microsoft.graph.security.ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) collection|Get the ediscoveryEstimateOperation resources from the lastEstimateStatisticsOperation navigation property.|
-|[List custodianSources](../api/security-ediscoverysearch-list-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Get the dataSource resources from the custodianSources navigation property.|
-|[Add custodianSources](../api/security-ediscoverysearch-post-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Add custodianSources by posting to the custodianSources collection.|
-|[Remove custodianSources](../api/security-ediscoverysearch-delete-custodiansources.md)|None|Remove a [dataSource](../resources/security-datasource.md) object.|
-|[List noncustodialSources](../api/security-ediscoverysearch-list-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|Get the ediscoveryNoncustodialDataSource resources from the noncustodialSources navigation property.|
-|[Add ediscoveryNoncustodialDataSource](../api/security-ediscoverysearch-post-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md)|Add noncustodialSources by posting to the noncustodialSources collection.|
-|[Remove noncustodialSources](../api/security-ediscoverysearch-delete-noncustodialsources.md)|None|Remove an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.|
+|[List additionalSources](../api/security-ediscoverysearch-list-additionalsources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Get the list of [additional sources](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Add additionalSources](../api/security-ediscoverysearch-post-additionalsources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Create a new [additional source](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[List ediscoveryEstimateOperation](../api/security-ediscoverysearch-list-lastestimatestatisticsoperation.md)|[microsoft.graph.security.ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) collection|Get the last [ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) objects and their properties.|
+|[List custodianSources](../api/security-ediscoverysearch-list-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Get the list of custodial data sources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Add custodianSources](../api/security-ediscoverysearch-post-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Create a new custodian source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Remove custodianSources](../api/security-ediscoverysearch-delete-custodiansources.md)|None|Remove a [microsoft.graph.security.dataSource](../resources/security-datasource.md) object.|
+|[List noncustodialSources](../api/security-ediscoverysearch-list-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|Get the list of non-custodialSources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Add noncustodialSources](../api/security-ediscoverysearch-post-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md)|Create a new non-custodial source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Remove noncustodialSources](../api/security-ediscoverysearch-delete-noncustodialsources.md)|None|Remove an [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.|
## Properties |Property|Type|Description|
Represents an eDiscovery search. For details, see [Collect data for a case in eD
|contentQuery|String|The query string in KQL (Keyword Query Language) query. For details, see [Keyword queries and search conditions for Content Search and eDiscovery](/microsoft-365/compliance/keyword-queries-and-search-conditions). You can refine searches by using fields paired with values; for example, *subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016*.| |createdBy|[identitySet](../resources/identityset.md)|The user who created the **eDiscovery search**.| |createdDateTime|DateTimeOffset|The date and time the **eDiscovery search** was created.|
-|dataSourceScopes|microsoft.graph.ediscovery.dataSourceScopes|When specified, the collection will span across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.|
+|dataSourceScopes|microsoft.graph.security.dataSourceScopes|When specified, the collection will span across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.|
|description|String|The description of the **eDiscovery search**.| |displayName|String|The display name of the **eDiscovery search**.| |id|String| The ID for the **eDiscovery search**. Read-only. |
v1.0 Security Ediscoverytagoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ediscoverytagoperation.md
Title: "ediscoveryTagOperation resource type"
-description: "Represents the process of tagging files in eDiscovery review set"
+description: "Represents the process of tagging files in eDiscovery review set."
ms.localizationpriority: medium ms.prod: "ediscovery"
doc_type: resourcePageType
Namespace: microsoft.graph.security [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]-
+Represents the process of tagging files in eDiscovery review set.
Inherits from [caseOperation](../resources/security-caseoperation.md).
None.
## Properties |Property|Type|Description| |:|:|:|
-|action|[microsoft.graph.security.caseAction](../resources/security-caseoperation.md#caseaction-values)| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|action|[microsoft.graph.security.caseAction](../resources/security-caseoperation.md#caseaction-values)| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`.|
|completedDateTime|DateTimeOffset| The date and time the operation was completed. | |createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. | |createdDateTime|DateTimeOffset| The date and time the operation was created. |
v1.0 Security Ocrsettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-ocrsettings.md
Title: "ocrSettings resource type"
-description: "OCR settings for an eDiscovery case"
+description: "Represents the OCR settings for an eDiscovery case."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-The OCR (Optical Character Recognition) settings for the eDiscovery case.
+Represents the Optical Character Recognition (OCR) settings for an eDiscovery case.
## Properties
The OCR (Optical Character Recognition) settings for the eDiscovery case.
|:|:|:| |isEnabled|Boolean|Indicates whether or not OCR is enabled for the case.| |maxImageSize|Int32|Maximum image size that will be processed in KB).|
-|timeout|Duration|The timeout duration for the OCR engine. A longer timeout may increase success of OCR, but may add to the total processing time.|
+|timeout|Duration|The timeout duration for the OCR engine. A longer timeout might increase success of OCR, but might add to the total processing time.|
## Relationships None.
v1.0 Security Redundancydetectionsettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-redundancydetectionsettings.md
Title: "redundancyDetectionSettings resource type"
-description: "Redundancy settings for an eDiscovery case."
+description: "Represents redundancy settings for an eDiscovery case."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Redundancy (email threading and near duplicate detection) settings for an eDiscovery case.
+Represents redundancy (email threading and near duplicate detection) settings for an eDiscovery case.
## Properties
v1.0 Security Sitesource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-sitesource.md
Title: "siteSource resource type"
-description: ""The container for a site associated with a custodian."
+description: "The container for a site associated with a custodian."
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)] The container for a site associated with a custodian.
-IInherits from [dataSource](../resources/security-datasource.md).
+Inherits from [dataSource](../resources/security-datasource.md).
## Methods
None.
|createdBy|[identitySet](../resources/identityset.md)|The user who created the **siteSource**.| |createdDateTime|DateTimeOffset|The date and time the **siteSource** was created.| |displayName|String|The display name of the **siteSource**. This will be the name of the SharePoint site.|
-|id|String| The ID of the **siteSource**. The site source can be retrieved at any time with [Get site](../api/site-get.md) - https://graph.microsoft.com/v1.0/sites/{siteId}|
-|holdStatus|String|The hold status of the **siteSource**.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|id|String| The ID of the **siteSource**. |
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **siteSource**. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`.|
## Relationships |Relationship|Type|Description|
The following is a JSON representation of the resource.
"blockType": "resource", "keyProperty": "id", "@odata.type": "microsoft.graph.security.siteSource",
- "baseType": "microsoft.graph.ediscovery.dataSource",
+ "baseType": "microsoft.graph.security.dataSource",
"openType": false } -->
v1.0 Security Topicmodelingsettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-topicmodelingsettings.md
Title: "topicModelingSettings resource type"
-description: "Topic modeling settings for an eDiscovery case"
+description: "Represents topic modeling settings for an eDiscovery case"
ms.localizationpriority: medium ms.prod: "ediscovery"
Namespace: microsoft.graph.security
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
-Topic modeling (Themes) settings for an eDiscovery case. To learn more, see [Configure search and analytics settings in Advanced eDiscovery](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery).
+Represents topic modeling (Themes) settings for an eDiscovery case. To learn more, see [Configure search and analytics settings in eDiscovery (Premium)](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery).
## Properties |Property|Type|Description| |:|:|:|
-|dynamicallyAdjustTopicCount|Boolean|To learn more, see [Adjust maximum number of themes dynamically](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
-|ignoreNumbers|Boolean|To learn more, see [Include numbers in themes](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
-|isEnabled|Boolean|Indicates whether themes is enabled for the case.|
-|topicCount|Int32|To learn more, see [Maximum number of themes](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
+|dynamicallyAdjustTopicCount|Boolean|Indicates whether the themes model should dynamically optimize the number of generated topics. To learn more, see [Adjust maximum number of themes dynamically](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
+|ignoreNumbers|Boolean|Indicates whether the themes model should exclude numbers while parsing document texts. To learn more, see [Include numbers in themes](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
+|isEnabled|Boolean|Indicates whether themes model is enabled for the case.|
+|topicCount|Int32|The total number of topics that the themes model will generate for a review set. To learn more, see [Maximum number of themes](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
## Relationships None.
v1.0 Security Unifiedgroupsource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-unifiedgroupsource.md
None.
|:|:|:| |createdBy|[identitySet](../resources/identityset.md)|The user who created the **unifiedGroupSource**.| |createdDateTime|DateTimeOffset|The date and time the **unifiedGroupSource** was created.|
-|displayName|String|The display name of the unified group - This is the name of the group.|
+|displayName|String|The display name of the unified group, which is the name of the group.|
|id|String|The ID of the **unifiedGroupSource**. This is not the ID of the actual group.|
-|includedSources|String|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
-|holdStatus|String|The hold status of the **unifiedGroupSource**.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **unifiedGroupSource**. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`.|
+
+### sourceType values
+|Member|Description|
+|:-|--|
+| mailbox | Represents a mailbox.|
+| site | Represents a SharePoint site.|
+ ## Relationships |Relationship|Type|Description| |:|:|:|
-|group|[group](../resources/group.md)|Represent a group.|
+|group|[group](../resources/group.md)|Represents a group.|
## JSON representation The following is a JSON representation of the resource.
v1.0 Security Usersource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/beta/resources/security-usersource.md
None.
|Property|Type|Description| |:|:|:| |createdBy|[identitySet](../resources/identityset.md)|The user who created the **userSource**.|
-|createdDateTime|DateTimeOffset|The date and time the **userSource** was created|
+|createdDateTime|DateTimeOffset|The date and time the **userSource** was created.|
|displayName|String|The display name associated with the mailbox and site.| |email|String|Email address of the user's mailbox.|
-|id|String|The ID of the **userSource**. This is not the ID of the actual group|
-|includedSources|String|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|id|String|The ID of the **userSource**. This is not the ID of the actual group.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
|siteWebUrl|String|The URL of the user's OneDrive for Business site. Read-only.|
-|holdStatus|String|The hold status of the **userSource**.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
-### sourceType values
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **userSource**. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`.|
-Types of source related to the user. Includes mailbox and site by default.
-
-|Member|Description|
-|:-|--|
-|mailbox|Represents a mailbox.|
-|site|Represents a OneDrive for Business site.|
### userSourceHoldStatus values |Name|Description| |:-|--|
-|notApplied|The userSource is not on Hold (all sources in it are not on hold).|
-|applied|The userSource is on Hold (all sources are on hold).|
+|notApplied|The userSource is not on hold (all sources in it are not on hold).|
+|applied|The userSource is on hold (all sources are on hold).|
|applying|The userSource is in applying hold state (applyHold operation triggered).|
-|removing|The userSource is in removing the hold state(removeHold operation triggered).|
+|removing|The userSource is in removing the hold state (removeHold operation triggered).|
|partial|The userSource is in mixed state where some sources are on hold and some not on hold or error state.| ## Relationships
v1.0 Security Caseoperation Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-caseoperation-get.md
+
+ Title: "Get caseOperation"
+description: "Read the properties and relationships of a caseOperation object."
+
+ms.localizationpriority: medium
++
+# Get caseOperation
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of a [caseOperation](../resources/security-caseoperation.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations/{caseOperationId}
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a [microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_caseoperation"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/operations/850c2f64b1ee44a4a69729327aac2b04
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.caseOperation"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/operations/$entity",
+ "@odata.type": "#microsoft.graph.security.ediscoveryAddToReviewSetOperation",
+ "createdDateTime": "2022-05-23T16:51:34.8281972Z",
+ "completedDateTime": "0001-01-01T00:00:00Z",
+ "percentProgress": 50,
+ "status": "running",
+ "action": "addToReviewSet",
+ "id": "850c2f64b1ee44a4a69729327aac2b04",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+}
+```
+
v1.0 Security Casesroot Delete Ediscoverycases https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-casesroot-delete-ediscoverycases.md
+
+ Title: "Delete ediscoveryCase"
+description: "Delete an ediscoveryCase."
+
+ms.localizationpriority: medium
++
+# Delete ediscoveryCase
+Namespace: microsoft.graph.security
+++
+Delete an [ediscoveryCase](../resources/security-ediscoverycase.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "delete_ediscoverycase"
+}
+-->
+``` http
+DELETE https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/22aa2acd-7554-4330-9ba9-ce20014aaae4
+```
+
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Casesroot List Ediscoverycases https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-casesroot-list-ediscoverycases.md
+
+ Title: "List ediscoveryCases"
+description: "Get a list of the eDiscovery cases"
+
+ms.localizationpriority: medium
++
+# List ediscoveryCases
+Namespace: microsoft.graph.security
+++
+Get a list of the [ediscoveryCase](../resources/security-ediscoverycase.md) objects and their properties.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoverycase"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoveryCase)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases",
+ "@odata.count": 22,
+ "value": [
+ {
+ "description": "",
+ "lastModifiedDateTime": "2022-05-19T23:30:41.23Z",
+ "status": "active",
+ "closedDateTime": null,
+ "externalId": "",
+ "id": "60f86305-ac3e-408b-baa2-ea585dd8b0c0",
+ "displayName": "My case 1",
+ "createdDateTime": "2022-05-19T23:30:41.23Z",
+ "lastModifiedBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": "MOD Administrator"
+ }
+ },
+ "closedBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": ""
+ }
+ }
+ },
+ {
+ "description": "",
+ "lastModifiedDateTime": "2022-05-18T23:05:07.82Z",
+ "status": "active",
+ "closedDateTime": null,
+ "externalId": "",
+ "id": "7acdda75-3559-4f93-9827-cbd4c89db033",
+ "displayName": "My case 2",
+ "createdDateTime": "2022-05-18T23:05:07.82Z",
+ "lastModifiedBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": "MOD Administrator"
+ }
+ },
+ "closedBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": ""
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Casesroot Post Ediscoverycases https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-casesroot-post-ediscoverycases.md
+
+ Title: "Create ediscoveryCase"
+description: "Create a new eDiscovery case."
+
+ms.localizationpriority: medium
++
+# Create ediscoveryCase
+Namespace: microsoft.graph.security
+++
+Create a new [ediscoveryCase](../resources/security-ediscoverycase.md) object.
+
+>[!NOTE]
+> This API only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see [Use the new case format in eDiscovery (Premium)](/microsoft-365/compliance/advanced-ediscovery-new-case-format).
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryCase](../resources/security-ediscoverycase.md) object.
+
+You can specify the following properties when you create an **ediscoveryCase**.
+
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|The name of the eDiscovery case. Required.|
+|description|String|The case description. Optional.|
+|externalId|String|The external case number for customer reference. Optional.|
+
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoverycase_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases
+Content-Type: application/json
+
+{
+ "displayName": "CONTOSO LITIGATION-005",
+ "description": "Project Bazooka",
+ "externalId": "324516"
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryCase"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases/$entity",
+ "description": "Project Bazooka",
+ "lastModifiedDateTime": "2022-05-22T18:36:48.0834353Z",
+ "status": "active",
+ "closedDateTime": "2022-05-22T18:36:48.083436Z",
+ "externalId": "324516",
+ "id": "22aa2acd-7554-4330-9ba9-ce20014aaae4",
+ "displayName": "CONTOSO LITIGATION-005",
+ "createdDateTime": "2022-05-22T18:36:48.0834351Z",
+ "lastModifiedBy": null,
+ "closedBy": null
+}
+```
+
v1.0 Security Ediscoverycase Close https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-close.md
+
+ Title: "Close eDiscoveryCase"
+description: "Close an eDiscoveryCase."
+
+ms.localizationpriority: medium
++
+# Close eDiscoveryCase
+
+Namespace: microsoft.graph.security
+++
+Close an eDiscovery case. For details, see [Close a case](/microsoft-365/compliance/close-or-delete-case#close-a-case).
+
+## Permissions
+
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/close
+```
+
+## Request headers
+
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+<!-- {
+ "blockType": "request",
+ "name": "close_ediscoverycase"
+}
+-->
+
+``` http
+POST https://graph.microsoft.com/security/cases/eDiscoveryCases/061b9a92-8926-4bd9-b41d-abf35edc7583/close
+```
+
+### Response
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverycase Delete Searches https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-delete-searches.md
+
+ Title: "Delete ediscoverySearch"
+description: "Delete an ediscoverySearch object."
+
+ms.localizationpriority: medium
++
+# Delete ediscoverySearch
+Namespace: microsoft.graph.security
+++
+Delete an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "delete_ediscoverysearch"
+}
+-->
+``` http
+DELETE https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/searches/60150269-9758-4439-9bc4-453c864d082f
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
+
v1.0 Security Ediscoverycase Delete Tags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-delete-tags.md
+
+ Title: "Remove ediscoveryReviewTag"
+description: "Remove an ediscoveryReviewTag object."
+
+ms.localizationpriority: medium
++
+# Remove ediscoveryReviewTag
+Namespace: microsoft.graph.security
+++
+Remove an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{tagId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "delete_parent_from_ediscoveryreviewtag"
+}
+-->
+``` http
+DELETE https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags/d05c2ef9369d49c293b5a6a6d18a5fd9
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
+
v1.0 Security Ediscoverycase Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-get.md
+
+ Title: "Get ediscoveryCase"
+description: "Read the properties and relationships of an ediscoveryCase object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryCase
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryCase](../resources/security-ediscoverycase.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoverycase"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/22aa2acd-7554-4330-9ba9-ce20014aaae4
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryCase"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases/$entity",
+ "description": "",
+ "lastModifiedDateTime": "2022-05-22T18:36:46.597Z",
+ "status": "active",
+ "closedDateTime": null,
+ "externalId": "324516",
+ "id": "22aa2acd-7554-4330-9ba9-ce20014aaae4",
+ "displayName": "CONTOSO LITIGATION-005",
+ "createdDateTime": "2022-05-22T18:36:46.597Z",
+ "lastModifiedBy": null,
+ "closedBy": null
+}
+```
v1.0 Security Ediscoverycase List Custodians https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-list-custodians.md
+
+ Title: "List ediscoveryCustodian"
+description: "Get a list of the ediscovery custodian object."
+
+ms.localizationpriority: medium
++
+# List ediscoveryCustodian
+Namespace: microsoft.graph.security
+++
+Get a list of the [custodian](../resources/security-ediscoverycustodian.md) objects and their properties.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+
+Do not supply a request body for this method.
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoverycustodian_from_"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians
+```
+
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryCustodian"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians",
+ "@odata.count": 1,
+ "value": [
+ {
+ "status": "active",
+ "holdStatus": "notApplied",
+ "createdDateTime": "2022-05-23T00:58:19.0702426Z",
+ "lastModifiedDateTime": "2022-05-23T00:58:19.0702436Z",
+ "releasedDateTime": null,
+ "id": "0053a61a3b6c42738f7606791716a22a",
+ "displayName": "Alex Wilber",
+ "email": "AlexW@M365x809305.OnMicrosoft.com",
+ "acknowledgedDateTime": "0001-01-01T00:00:00Z"
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverycase List Noncustodialdatasources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-list-noncustodialdatasources.md
+
+ Title: "List ediscoveryNoncustodialDataSources"
+description: "Get a list of ediscoveryNoncustodialDataSource objects."
+
+ms.localizationpriority: medium
++
+# List ediscoveryNoncustodialDataSources
+Namespace: microsoft.graph.security
+++
+Get a list of the [non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md) and their properties.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoverynoncustodialdatasource_from_"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources?$expand=dataSource
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryNoncustodialDataSource"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources(dataSource())",
+ "@odata.count": 3,
+ "value": [
+ {
+ "status": "active",
+ "holdStatus": "applied",
+ "createdDateTime": "2022-05-23T02:09:11.1395287Z",
+ "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
+ "releasedDateTime": "0001-01-01T00:00:00Z",
+ "id": "35393639323133394345384344303043",
+ "displayName": "U.S. Sales",
+ "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('35393639323133394345384344303043')/dataSource/$entity",
+ "dataSource": {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "displayName": "U.S. Sales",
+ "createdDateTime": "2022-05-23T02:09:11.1395535Z",
+ "holdStatus": "0",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/USSales",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdDateTime": "2022-05-23T02:09:11.1395535Z"
+ }
+ }
+ },
+ {
+ "status": "active",
+ "holdStatus": "applied",
+ "createdDateTime": "2022-05-23T02:09:11.1395287Z",
+ "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
+ "releasedDateTime": "0001-01-01T00:00:00Z",
+ "id": "31453237353743363432414242344641",
+ "displayName": "Sales and Marketing",
+ "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('31453237353743363432414242344641')/dataSource/$entity",
+ "dataSource": {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/74f6c798-fc32-4dbe-9e5b-8e11459b9f44",
+ "displayName": "Sales and Marketing",
+ "createdDateTime": "2022-05-23T02:09:11.1397925Z",
+ "holdStatus": "0",
+ "id": "74f6c798-fc32-4dbe-9e5b-8e11459b9f44",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/SalesAndMarketing",
+ "id": "74f6c798-fc32-4dbe-9e5b-8e11459b9f44",
+ "createdDateTime": "2022-05-23T02:09:11.1397925Z"
+ }
+ }
+ },
+ {
+ "status": "active",
+ "holdStatus": "applied",
+ "createdDateTime": "2022-05-23T02:09:11.1395287Z",
+ "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
+ "releasedDateTime": "0001-01-01T00:00:00Z",
+ "id": "46333131344239353834433430454335",
+ "displayName": "Retail",
+ "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('46333131344239353834433430454335')/dataSource/$entity",
+ "dataSource": {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/dbe4b18e-2765-4989-8647-48139180c45f",
+ "displayName": "Retail",
+ "createdDateTime": "2022-05-23T02:09:11.1399861Z",
+ "holdStatus": "0",
+ "id": "dbe4b18e-2765-4989-8647-48139180c45f",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/Retail",
+ "id": "dbe4b18e-2765-4989-8647-48139180c45f",
+ "createdDateTime": "2022-05-23T02:09:11.1399861Z"
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverycase List Operations https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-list-operations.md
+
+ Title: "List caseOperations"
+description: "Get a list of the caseOperation objects and their properties."
+
+ms.localizationpriority: medium
++
+# List caseOperations
+Namespace: microsoft.graph.security
+++
+Get a list of the [caseOperation](../resources/security-caseoperation.md) objects and their properties.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/operations
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_caseoperation"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/operations
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.caseOperation)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/operations",
+ "value": [
+ {
+ "createdDateTime": "2022-05-23T01:09:36.834501Z",
+ "completedDateTime": "2022-05-23T01:10:08.8710734Z",
+ "percentProgress": 100,
+ "status": "succeeded",
+ "action": "holdUpdate",
+ "id": "1ab699d7e53d46de944144c4a650d66f",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "0d38933a-0bbd-41ca-9ebd-28c4b5ba7cb7",
+ "displayName": null,
+ "userPrincipalName": null
+ }
+ }
+ }
+ ]
+}
+```
v1.0 Security Ediscoverycase List Reviewsets https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-list-reviewsets.md
+
+ Title: "List reviewSets"
+description: "Get the ediscoveryReviewSet resources from an eDiscovery case object"
+
+ms.localizationpriority: medium
++
+# List reviewSets
+Namespace: microsoft.graph.security
+
+Get a list of [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects associated with an eDiscovery case.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoveryreviewset"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/reviewSets
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoveryReviewSet)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/reviewSets",
+ "value": [
+ {
+ "displayName": "My review set",
+ "id": "025852b3-5062-4169-9609-9861a6fe2fe5",
+ "createdDateTime": "2022-05-23T16:26:08.7203883Z",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverycase List Searches https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-list-searches.md
+
+ Title: "List searches"
+description: "Get the list of searches from an eDiscovery case"
+
+ms.localizationpriority: medium
++
+# List searches
+Namespace: microsoft.graph.security
+++
+Get the list of [ediscoverySearch](../resources/security-ediscoverysearch.md) resources from an [eDiscoveryCase](../resources/security-ediscoverycase.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoverysearch"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoverySearch)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/searches",
+ "value": [
+ {
+ "dataSourceScopes": "none",
+ "description": "My first search",
+ "lastModifiedDateTime": "2022-05-23T04:38:07.5787454Z",
+ "contentQuery": "(Author=\"edison\")",
+ "id": "46867792-68e6-41db-9cd0-f651c2290d91",
+ "displayName": "My search 2",
+ "createdDateTime": "2022-05-23T04:38:07.5787454Z",
+ "lastModifiedBy": null,
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+ },
+ {
+ "dataSourceScopes": "none",
+ "description": "My first search",
+ "lastModifiedDateTime": "2022-05-23T04:35:36.5424818Z",
+ "contentQuery": "(Author=\"edison\")",
+ "id": "80b9d59a-12a6-4273-a3d4-ab78f9a04ea5",
+ "displayName": "My search 1",
+ "createdDateTime": "2022-05-23T04:35:36.5424818Z",
+ "lastModifiedBy": null,
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverycase List Tags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-list-tags.md
+
+ Title: "List tags"
+description: "Get the list of ediscoveryReviewTag objects from an eDiscovery case object."
+
+ms.localizationpriority: medium
++
+# List tags
+Namespace: microsoft.graph.security
+
+Get a list of [eDiscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) objects and their properties.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryreviewtag](../resources/security-ediscoveryreviewtag.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoveryreviewtag_from_"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewTag"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/tags",
+ "@odata.count": 5,
+ "value": [
+ {
+ "displayName": "My tag",
+ "lastModifiedDateTime": "2022-05-23T19:41:01.7432683Z",
+ "childSelectability": "Many",
+ "id": "062de822f17a4a2e9b833aa3f6c37108",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ },
+ {
+ "displayName": "Responsive",
+ "description": "",
+ "lastModifiedDateTime": "2022-05-23T19:41:24.4237284Z",
+ "childSelectability": "One",
+ "id": "d3d99dc704a74801b792b3e1e722aa0d",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ },
+ {
+ "displayName": "Not responsive",
+ "lastModifiedDateTime": "2022-05-23T19:41:31.3381716Z",
+ "childSelectability": "One",
+ "id": "ced26633616a434abd83762d49a25a6c",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ },
+ {
+ "displayName": "Processing",
+ "description": "Determine whether to outsource processing",
+ "lastModifiedDateTime": "2022-05-23T19:46:03.8746996Z",
+ "childSelectability": "Many",
+ "id": "d8580989505c4fb3a25b845013697cf7",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ },
+ {
+ "displayName": "External",
+ "lastModifiedDateTime": "2022-05-23T19:46:10.5212362Z",
+ "childSelectability": "One",
+ "id": "d05c2ef9369d49c293b5a6a6d18a5fd9",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ }
+ ]
+}
+```
v1.0 Security Ediscoverycase Post Custodians https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-post-custodians.md
+
+ Title: "Create custodians"
+description: "Create a new ediscoveryCustodian object."
+
+ms.localizationpriority: medium
++
+# Create custodians
+Namespace: microsoft.graph.security
+++
+Create a new [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object.
+After the custodian object is created, you will need to create the custodian's [userSource](../resources/security-usersource.md) to reference their mailbox and OneDrive for Business site.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object.
+
+You can specify the following properties when you create an **ediscoveryCustodian**.
+
+|Property|Type|Description|
+|:|:|:|
+|email|String|Custodian's primary SMTP address. Required.|
+
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoverycustodian_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians
+Content-Type: application/json
+
+{
+ "email":"AdeleV@contoso.com",
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryCustodian"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('4c8f8f70-7785-4bd4-b296-c98376a2c5e1')/custodians/$entity",
+ "status": "active",
+ "holdStatus": "applied",
+ "createdDateTime": "2022-05-23T00:58:19.0702426Z",
+ "lastModifiedDateTime": "2022-05-23T00:58:19.0702436Z",
+ "releasedDateTime": null,
+ "id": "0053a61a3b6c42738f7606791716a22a",
+ "displayName": "Adele Vance",
+ "email": "AdeleV@contoso.com",
+ "acknowledgedDateTime": "0001-01-01T00:00:00Z"
+}
+```
v1.0 Security Ediscoverycase Post Noncustodialdatasources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-post-noncustodialdatasources.md
+
+ Title: "Create nonCustodialDataSources"
+description: "Create a new ediscoveryNoncustodialDataSource object."
+
+ms.localizationpriority: medium
++
+# Create nonCustodialDataSources
+Namespace: microsoft.graph.security
+
+Create a new [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
+
+You can specify the following properties when you create an **ediscoveryNoncustodialDataSource**.
+
+|Property|Type|Description|
+|:|:|:|
+|dataSource|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Required. Either a [microsoft.graph.security.userSource](../resources/security-usersource.md) or [microsoft.graph.security.siteSource](../resources/security-sitesource.md).
+
+For userSource, use "dataSource" : { "@odata.type" : "microsoft.graph.security.userSource", "email" : "SMTP address"}.
+For siteSource use "dataSource" : { "@odata.type" : "microsoft.graph.security.siteSource", "site@odata.bind" : "siteId" },
+Alternatively use the webUrl directly, "dataSource": {"@odata.type": "microsoft.graph.security.siteSource","site": {"webUrl": `https://m365x809305.sharepoint.com/sites/Design-topsecret`}}
++
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoverynoncustodialdatasource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialDataSources
+Content-Type: application/json
+
+{
+ "dataSource": {
+ "@odata.type": "microsoft.graph.security.siteSource",
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/Design-topsecret"
+ }
+ }
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryNoncustodialDataSource"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources/$entity",
+ "status": "active",
+ "holdStatus": "notApplied",
+ "createdDateTime": "2022-05-23T03:15:08.5354451Z",
+ "lastModifiedDateTime": "2022-05-23T03:15:08.5354451Z",
+ "releasedDateTime": "0001-01-01T00:00:00Z",
+ "id": "43373338343345303943344434423032",
+ "displayName": "Design - top secret"
+}
+```
v1.0 Security Ediscoverycase Post Reviewsets https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-post-reviewsets.md
+
+ Title: "Create reviewSets"
+description: "Create a new ediscoveryReviewSet object."
+
+ms.localizationpriority: medium
++
+# Create reviewSets
+Namespace: microsoft.graph.security
+++
+Create a new [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.
+
+You can specify the following properties when you create an **ediscoveryReviewSet**.
+
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|The name of the review set. Required.|
++
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoveryreviewset_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/reviewSets
+Content-Type: application/json
+
+{
+ "displayName": "My review set 2"
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewSet"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/reviewSets/$entity",
+ "displayName": "My review set 2",
+ "id": "887306f5-1eb4-4409-b18c-ba47f4e3fa9b",
+ "createdDateTime": "2022-05-23T16:33:13.5126494Z",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null,
+ "userPrincipalName": "c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverycase Post Searches https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-post-searches.md
+
+ Title: "Create searches"
+description: "Create a new ediscoverySearch object."
+
+ms.localizationpriority: medium
++
+# Create searches
+Namespace: microsoft.graph.security
+++
+Create a new [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
+
+You can specify the following properties when you create an **ediscoverySearch**.
+
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|The display name of the search. Required|
+|description|String|The description of the search Optional.|
+|contentQuery|String|The query string used for the search. The query string in KQL (Keyword Query Language) format. Optional|
+|dataSourceScopes|microsoft.graph.security.dataSourceScopes|The option to search across all mailboxes or sites in the tenant. The possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`. Optional.|
+
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoverysearch_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches
+Content-Type: application/json
+
+{
+ "displayName": "My search 2",
+ "description": "My first search",
+ "contentQuery": "(Author=\"edison\")",
+ "custodianSources@odata.bind": [
+ "https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
+ "https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')"
+ ],
+ "noncustodialSources@odata.bind": [
+ "https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043"
+ ]
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoverySearch"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/searches/$entity",
+ "dataSourceScopes": "none",
+ "description": "My first search",
+ "lastModifiedDateTime": "2022-05-23T04:38:07.5787454Z",
+ "contentQuery": "(Author=\"edison\")",
+ "id": "46867792-68e6-41db-9cd0-f651c2290d91",
+ "displayName": "My search 2",
+ "createdDateTime": "2022-05-23T04:38:07.5787454Z",
+ "lastModifiedBy": null,
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverycase Post Tags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-post-tags.md
+
+ Title: "Create tags"
+description: "Create a new ediscoveryReviewTag object."
+
+ms.localizationpriority: medium
++
+# Create tags
+Namespace: microsoft.graph.security
+
+Create a new [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
+
+You can specify the following properties when you create an **ediscoveryReviewTag**.
+
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|Display name of the tag. Required.|
+|description|String|Description of the tag. Optional.|
+|childSelectability|microsoft.graph.security.childSelectability|This value controls whether the UX presents the tags as checkboxes or a radio button group. The possible values are: `One`, `Many`. Required.|
+
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object in the response body.
+
+## Examples
+
+### Example 1: Create a tag
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoveryreviewtag_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags
+
+{
+ "displayName": "My tag API",
+ "description": "Use Graph API to create tags",
+ "childSelectability": "Many"
+}
+```
++
+#### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewTag"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/tags/$entity",
+ "displayName": "My tag API",
+ "description": "Use Graph API to create tags",
+ "lastModifiedDateTime": "2022-05-23T19:58:26.1573076Z",
+ "childSelectability": "Many",
+ "id": "7c6cc351-fb90-431f-8562-1b607a3144a4",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
+
+### Example 2: Create a tag with a parent
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoveryreviewtag_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags
+
+{
+ "displayName": "My tag API",
+ "description": "Use Graph API to create tags",
+ "childSelectability": "Many",
+ "parent@odata.bind":""
+}
+```
++
+#### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewTag"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/tags/$entity",
+ "displayName": "My tag API",
+ "description": "Use Graph API to create tags",
+ "lastModifiedDateTime": "2022-05-23T19:58:26.1573076Z",
+ "childSelectability": "Many",
+ "id": "7c6cc351-fb90-431f-8562-1b607a3144a4",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
v1.0 Security Ediscoverycase Reopen https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-reopen.md
+
+ Title: "Reopen eDiscoveryCase"
+description: "Reopen an eDiscoveryCase that was closed."
+
+ms.localizationpriority: medium
++
+# eDiscoveryCase: reopen
+
+Namespace: microsoft.graph.security
+++
+Reopen an eDiscovery case that was closed. For details, see [Reopen a closed case](/microsoft-365/compliance/close-or-delete-case#reopen-a-closed-case).
+
+## Permissions
+
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reopen
+```
+
+## Request headers
+
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+
+<!-- {
+ "blockType": "request",
+ "name": "reopen_ediscoverycase"
+}
+-->
+``` http
+POST https://graph.microsoft.com/security/cases/eDiscoveryCases/061b9a92-8926-4bd9-b41d-abf35edc7583/reopen
+```
+### Response
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverycase Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycase-update.md
+
+ Title: "Update ediscoveryCase"
+description: "Update the properties of an ediscoveryCase object."
+
+ms.localizationpriority: medium
++
+# Update ediscoveryCase
+Namespace: microsoft.graph.security
+++
+Update the properties of an [ediscoveryCase](../resources/security-ediscoverycase.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
++
+In the request body, supply the values for relevant fields that should be updated. Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For best performance, don't include existing values that haven't changed.
+
+| Property | Type | Description |
+|:-|:|:|
+|description|String|The case description.|
+|displayName|String|The case name.|
+|externalId|String|The external case number for customer reference.|
+
+## Response
+
+If successful, this method returns a `204 NO CONTENT` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "update_ediscoverycase"
+}
+-->
+``` http
+PATCH https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/22aa2acd-7554-4330-9ba9-ce20014aaae4
+Content-Type: application/json
+
+{
+ "displayName": "My Case 1 - Renamed",
+ "description": "Updated description"
+}
+```
+
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+```http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverycasesettings Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycasesettings-get.md
+
+ Title: "Get ediscoveryCaseSettings"
+description: "Read the properties and relationships of an ediscoveryCaseSettings object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryCaseSettings
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoverycasesettings"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/settings
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryCaseSettings"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/settings/$entity",
+ "id": "b0073e4e-4184-41c6-9eb7-8c8cc3e2288b",
+ "redundancyDetection": {
+ "isEnabled": true,
+ "similarityThreshold": 65,
+ "minWords": 10,
+ "maxWords": 500000
+ },
+ "topicModeling": {
+ "isEnabled": false,
+ "ignoreNumbers": true,
+ "topicCount": 100,
+ "dynamicallyAdjustTopicCount": true
+ },
+ "ocr": {
+ "isEnabled": false,
+ "maxImageSize": 24576,
+ "timeout": "PT1M"
+ }
+}
+```
+
v1.0 Security Ediscoverycasesettings Resettodefault https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycasesettings-resettodefault.md
+
+ Title: "Reset ediscoveryCaseSettings to default"
+description: "Reset a ediscoveryCaseSettingsobject to the default values."
+
+ms.localizationpriority: medium
++
+# eDiscoveryCaseSettings: resetToDefault
+
+Namespace: microsoft.graph.security
+++
+Reset a [caseSettings](../resources/security-ediscoverycaseSettings.md) object to the default values.
+
+## Permissions
+
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings/resetToDefault
+```
+
+## Request headers
+
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `200 OK` response code.
+
+## Examples
+
+### Request
+
+<!-- {
+ "blockType": "request",
+ "name": "settings_resettodefault"
+}
+-->
+
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/settings/resettodefault
+```
+### Response
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+
+``` http
+HTTP/1.1 200 OK
+```
v1.0 Security Ediscoverycasesettings Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycasesettings-update.md
+
+ Title: "Update ediscoveryCaseSettings"
+description: "Update the properties of an ediscoveryCaseSettings object."
+
+ms.localizationpriority: medium
++
+# Update ediscoveryCaseSettings
+Namespace: microsoft.graph.security
+++
+Update the properties of an [ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+++
+|Property|Type|Description|
+|:|:|:|
+|redundancyDetection|[microsoft.graph.security.redundancyDetectionSettings](../resources/security-redundancydetectionsettings.md)|Redundancy (email threading and near duplicate detection) settings for an eDiscovery case. Optional.|
+|topicModeling|[microsoft.graph.security.topicModelingSettings](../resources/security-topicmodelingsettings.md)|Topic modeling (Themes) settings for an eDiscovery case. Optional.|
+|ocr|[microsoft.graph.security.ocrSettings](../resources/security-ocrsettings.md)|The OCR (Optical Character Recognition) settings for the eDiscovery case. Optional.|
+++
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "update_ediscoverycasesettings"
+}
+-->
+``` http
+PATCH https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/settings
+Content-Type: application/json
+
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryCaseSettings",
+ "redundancyDetection": {
+ "@odata.type": "microsoft.graph.security.redundancyDetectionSettings"
+ },
+ "topicModeling": {
+ "@odata.type": "microsoft.graph.security.topicModelingSettings"
+ },
+ "ocr": {
+ "@odata.type": "microsoft.graph.security.ocrSettings"
+ }
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverycustodian Activate https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-activate.md
+
+ Title: "ediscoveryCustodian: activate"
+description: "Re-activate a custodian from a case."
+
+ms.localizationpriority: medium
++
+# ediscoveryCustodian: activate
+Namespace: microsoft.graph.security
+++
+Activate a custodian that has been released from a case to make them part of the case again. For details, see [Manage custodians in an eDiscovery (Premium) case](/microsoft-365/compliance/manage-new-custodians#re-activate-custodian).
++
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/activate
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.activate"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/activate
+```
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoverycustodian Applyhold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-applyhold.md
+
+ Title: "ediscoveryCustodian: applyHold"
+description: "Start the process of applying hold to eDiscovery custodians."
+
+ms.localizationpriority: medium
++
+# ediscoveryCustodian: applyHold
+Namespace: microsoft.graph.security
+
+Start the process of applying hold on [eDiscovery custodians](../resources/security-ediscoverycustodian.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/applyHold
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/applyHold
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the parameters.
+
+The following table shows the parameters that can be used with this action.
+
+|Parameter|Type|Description|
+|:|:|:|
+|ids|String collection|The IDs of custodians to apply hold. Optional.|
++
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Example 1: Apply hold to multiple custodians
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.applyhold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/applyHold
+Content-Type: application/json
+
+{
+ "ids": [
+ "7f697316-43ed-48e1-977f-261be050db93", "b26888b3-e1f5-47c5-bdf2-33d1b90cb2e8"
+ ]
+}
+```
++
+#### Response
+The following is an example of the response.
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
+
+### Example 2: Apply hold to a single custodian
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.applyhold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/c25c3914f9f743ee9cbaa25377e0cec6/applyHold
+```
++
+#### Response
+The following is an example of the response.
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoverycustodian Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-get.md
+
+ Title: "Get ediscoveryCustodian"
+description: "Read the properties and relationships of an ediscoveryCustodian object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryCustodian
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/custodian
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoverycustodian"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryCustodian"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians/$entity",
+ "status": "active",
+ "holdStatus": "applied",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "lastModifiedDateTime": "2022-05-23T02:35:42.9272828Z",
+ "releasedDateTime": "0001-01-01T00:00:00Z",
+ "id": "0053a61a3b6c42738f7606791716a22a",
+ "displayName": "Alex Wilber",
+ "email": "AlexW@M365x809305.OnMicrosoft.com",
+ "acknowledgedDateTime": "0001-01-01T00:00:00Z"
+}
+```
v1.0 Security Ediscoverycustodian List Lastindexoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-list-lastindexoperation.md
+
+ Title: "List lastIndexOperation"
+description: "Get a list of the ediscoveryIndexOperations associated with an ediscoveryCustodian."
+
+ms.localizationpriority: medium
++
+# List lastIndexOperation
+Namespace: microsoft.graph.security
+++
+Get a list of the [ediscoveryIndexOperations](../resources/security-ediscoveryindexoperation.md) associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoverycustodianId}/lastIndexOperation
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialSources/{ediscoveryNoncustodialDataSourceId}/lastIndexOperation
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoveryindexoperation"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/lastIndexOperation
+```
+
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryIndexOperation"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.security.ediscoveryIndexOperation",
+ "createdDateTime": "2022-05-23T02:35:43.1932326Z",
+ "completedDateTime": "0001-01-01T00:00:00Z",
+ "percentProgress": 0,
+ "status": "running",
+ "action": "index",
+ "id": "b23821836460441891d16a2cb7463392",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null,
+ "userPrincipalName": "c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverycustodian List Sitesources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-list-sitesources.md
+
+ Title: "List siteSources"
+description: "Get the siteSource resources from the siteSources navigation property."
+
+ms.localizationpriority: medium
++
+# List siteSources
+Namespace: microsoft.graph.security
+++
+Get a list of the [siteSource](../resources/security-sitesource.md) objects associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.siteSource](../resources/security-sitesource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_sitesource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.siteSource)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/siteSources",
+ "value": [
+ {
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "displayName": "U.S. Sales",
+ "createdDateTime": "2022-05-23T02:35:42.926309Z",
+ "holdStatus": "applied",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/USSales",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdDateTime": "2022-05-23T02:35:42.926309Z"
+ }
+ }
+ ]
+}
+```
v1.0 Security Ediscoverycustodian List Unifiedgroupsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-list-unifiedgroupsources.md
+
+ Title: "List custodian's unifiedGroupSources"
+description: "Get a list of the custodian's unifiedGroupSource objects and their properties."
+
+ms.localizationpriority: medium
++
+# List unifiedGroupSources
+Namespace: microsoft.graph.security
+++
+Get a list of the [unifiedGroupSource](../resources/security-unifiedgroupsource.md) objects associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_unifiedgroupsource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/unifiedGroupSources
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.unifiedGroupSource)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources",
+ "value": [
+ {
+ "@odata.id": "https://graph.microsoft.com/v1.0/groups/32e14fa4-3106-4bd2-a245-34bf0c718a7e",
+ "displayName": "Design (Mailbox)",
+ "createdDateTime": "2022-05-23T02:35:42.926309Z",
+ "holdStatus": "applied",
+ "id": "32e14fa4-3106-4bd2-a245-34bf0c718a7e",
+ "includedSources": "mailbox,site",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "group": {
+ "email": "Design@M365x809305.onmicrosoft.com",
+ "webUrl": "https://m365x809305.sharepoint.com/sites/Design",
+ "id": "32e14fa4-3106-4bd2-a245-34bf0c718a7e",
+ "displayName": "Design (Mailbox)",
+ "createdDateTime": "2022-05-23T02:35:42.926309Z"
+ }
+ },
+ {
+ "@odata.id": "https://graph.microsoft.com/v1.0/groups/21be9868-b58b-4f8b-800c-591e9ad8d4ec",
+ "displayName": "CEO Connection (Mailbox)",
+ "createdDateTime": "2022-05-23T02:35:42.926309Z",
+ "holdStatus": "applied",
+ "id": "21be9868-b58b-4f8b-800c-591e9ad8d4ec",
+ "includedSources": "mailbox,site",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "group": {
+ "email": "ceoconnection@M365x809305.onmicrosoft.com",
+ "webUrl": "https://m365x809305.sharepoint.com/sites/ceoconnection",
+ "id": "21be9868-b58b-4f8b-800c-591e9ad8d4ec",
+ "displayName": "CEO Connection (Mailbox)",
+ "createdDateTime": "2022-05-23T02:35:42.926309Z"
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverycustodian List Usersources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-list-usersources.md
+
+ Title: "List userSources"
+description: "Get the userSource resources from the userSources navigation property."
+
+ms.localizationpriority: medium
++
+# List userSources
+Namespace: microsoft.graph.security
+++
+Get a list of the [userSource](../resources/security-usersource.md) objects associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.userSource](../resources/security-usersource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_usersource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.userSource)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/userSources",
+ "value": [
+ {
+ "displayName": "Alex Wilber",
+ "createdDateTime": "2022-05-23T00:58:19.0702524Z",
+ "holdStatus": "applied",
+ "id": "43434642-3137-3138-3432-374142313639",
+ "email": "AlexW@M365x809305.OnMicrosoft.com",
+ "includedSources": "mailbox,site",
+ "siteWebUrl": "https://m365x809305-my.sharepoint.com/personal/alexw_m365x809305_onmicrosoft_com/",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverycustodian Post Sitesources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-post-sitesources.md
+
+ Title: "Create custodian siteSource"
+description: "Create a new custodian siteSource object associated with an eDiscovery custodian."
+
+ms.localizationpriority: medium
++
+# Create siteSource
+Namespace: microsoft.graph.security
+++
+Create a new [siteSource](../resources/security-sitesource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [siteSource](../resources/security-sitesource.md) object.
+
+You can specify the following properties when you create a **siteSource**.
+
+|Property|Type|Description|
+|:|:|:|
+|site|String|URL of the site; for example, `https://contoso.sharepoint.com/sites/HumanResources`.|
++
+## Response
+
+If successful, this method returns a `201 Created` response code and a [microsoft.graph.security.siteSource](../resources/security-sitesource.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_sitesource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources
+Content-Type: application/json
+
+{
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/Retail"
+ }
+}
+```
+
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.siteSource"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/siteSources/$entity",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/dbe4b18e-2765-4989-8647-48139180c45f",
+ "displayName": "Retail",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "applied",
+ "id": "dbe4b18e-2765-4989-8647-48139180c45f",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverycustodian Post Unifiedgroupsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-post-unifiedgroupsources.md
+
+ Title: "Create custodian unifiedGroupSource"
+description: "Create a new custodian unifiedGroupSource object associated with an eDiscovery custodian."
+
+ms.localizationpriority: medium
++
+# Create custodian unifiedGroupSource
+Namespace: microsoft.graph.security
+++
+Create a new [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object.
+
+You can specify the following properties when you create an **unifiedGroupSource**.
+
+>**Note:** Either **group** or **group@odata.bind** is required in order to create a **unifiedGroupSource**.
+
+|Property|Type|Description|
+|:|:|:|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|group|String|Specifies the email address for the group. To get the email address of a group, use [List groups](../api/group-list.md) or [Get group](../api/group-get.md). You can then query by the name of the group using `$filter`; for example, `https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'secret group'&$select=mail,id,displayName`.|
+|group@odata.bind|String|ID of the group. You can get this in the same way that you get the group. |
+
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) object in the response body.
+
+## Examples
+
+### Example 1: Create unifiedGroupSource with group SMTP address
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_unifiedgroupsource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/beta/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/unifiedGroupSources
+Content-Type: application/json
+
+{
+ "group": {
+ "mail": "SOCTeam@M365x809305.onmicrosoft.com"
+ },
+ "includedSources": "mailbox, site"
+}
+```
++
+#### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.unifiedGroupSource"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources/$entity",
+ "@odata.id": "https://graph.microsoft.com/v1.0/groups/1ce58bf6-e0fd-403d-a655-312a838110cf",
+ "displayName": "SOC Team (Mailbox)",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "applied",
+ "id": "1ce58bf6-e0fd-403d-a655-312a838110cf",
+ "includedSources": "mailbox,site",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
+
+### Example 2: Create unifiedGroupSource with group@odata.bind
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_unifiedgroupsource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/unifiedGroupSources
+Content-Type: application/json
+
+{
+ "group@odata.bind": "https://graph.microsoft.com/v1.0/groups/93f90172-fe05-43ea-83cf-ff785a40d610",
+ "includedSources": "mailbox"
+}
+```
++
+#### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.unifiedGroupSource"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources/$entity",
+ "@odata.id": "https://graph.microsoft.com/v1.0/groups/93f90172-fe05-43ea-83cf-ff785a40d610",
+ "displayName": "Finance Team (Mailbox)",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "applied",
+ "id": "93f90172-fe05-43ea-83cf-ff785a40d610",
+ "includedSources": "mailbox",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
v1.0 Security Ediscoverycustodian Post Usersources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-post-usersources.md
+
+ Title: "Create custodian userSource"
+description: "Create a new custodian userSource object associated with an eDiscovery custodian."
+
+ms.localizationpriority: medium
++
+# Create custodian userSource
+Namespace: microsoft.graph.security
+++
+Create a new [userSource](../resources/security-usersource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [userSource](../resources/security-usersource.md) object.
+
+You can specify the following properties when you create a **userSource**.
+
+|Property|Type|Description|
+|:|:|:|
+|email|String|SMTP address of the user.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+
+## Response
+
+If successful, this method returns a `201 Created` response code and a [microsoft.graph.security.userSource](../resources/security-usersource.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_usersource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources
+
+{
+ "email": "admin@M365x809305.onmicrosoft.com",
+ "includedSources": "mailbox, site"
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.userSource"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/userSources/$entity",
+ "displayName": "MOD Administrator",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "applied",
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "email": "admin@M365x809305.onmicrosoft.com",
+ "includedSources": "mailbox,site",
+ "siteWebUrl": "",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverycustodian Release https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-release.md
+
+ Title: "ediscoveryCustodian: release"
+description: "Release a custodian from a case."
+
+ms.localizationpriority: medium
+
+# ediscoveryCustodian: release
+Namespace: microsoft.graph.security
+++
+Release a custodian from a case. For details, see [Release a custodian from a case](/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/release
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.release"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/c25c3914f9f743ee9cbaa25377e0cec6/release
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoverycustodian Removehold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-removehold.md
+
+ Title: "ediscoveryCustodian: removeHold"
+description: "**TODO: Add Description**"
+
+ms.localizationpriority: medium
++
+# ediscoveryCustodian: removeHold
+Namespace: microsoft.graph.security
+
+Start the process of removing hold from [eDiscovery custodians](../resources/security-ediscoverycustodian.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/removeHold
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{eDiscoveryCustodianId}/removeHold
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the parameters.
+
+The following table shows the parameters that can be used with this action.
+
+|Parameter|Type|Description|
+|:|:|:|
+|ids|String collection|The IDs of custodians to apply hold. Optional.|
++
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+### Example 1: Remove hold from multiple custodians
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.removehold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/removeHold
+Content-Type: application/json
+
+{
+ "ids": [
+ "7f697316-43ed-48e1-977f-261be050db93", "b26888b3-e1f5-47c5-bdf2-33d1b90cb2e8"
+ ]
+}
+```
++
+#### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
+
+### Example 2: Remove hold from a single custodian
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.removehold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/c25c3914f9f743ee9cbaa25377e0cec6/removeHold
+```
++
+#### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoverycustodian Updateindex https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverycustodian-updateindex.md
+
+ Title: "ediscoveryCustodian: updateIndex"
+description: "Trigger an indexOperation to make a custodian and associated sources searchable."
+
+ms.localizationpriority: medium
++
+# ediscoveryCustodian: updateIndex
+Namespace: microsoft.graph.security
+++
+Trigger an [indexOperation](../resources/security-ediscoveryIndexOperation.md) to make a custodian and associated sources searchable.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/updateIndex
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.updateindex"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/c25c3914f9f743ee9cbaa25377e0cec6/updateIndex
+```
++
+### Response
+The following is an example of the response.
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
+
v1.0 Security Ediscoverynoncustodialdatasource Applyhold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverynoncustodialdatasource-applyhold.md
+
+ Title: "ediscoveryNoncustodialDataSource: applyHold"
+description: "Start the process of applying hold to eDiscovery non-custodial data sources."
+
+ms.localizationpriority: medium
++
+# ediscoveryNoncustodialDataSource: applyHold
+Namespace: microsoft.graph.security
++
+Start the process of applying hold on [eDiscovery non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/applyHold
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/applyHold
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the parameters.
+
+The following table shows the parameters that can be used with this action.
+
+|Parameter|Type|Description|
+|:|:|:|
+|ids|String collection|The IDs of non-custodial data sources to apply hold. Optional.|
++
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Example 1: Apply hold to multiple non-custodial data sources
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverynoncustialdatasource.applyhold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/applyHold
+Content-Type: application/json
+
+{
+ "ids": [
+ "39333641443238353535383731453339",
+ "46333131344239353834433430454335"
+ ]
+}
+```
++
+#### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
+
+### Example 2: Apply hold to a single non-custodial data source
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverynoncustialdatasource.applyhold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/39333641443238353535383731453339/applyHold
+```
++
+#### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoverynoncustodialdatasource Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverynoncustodialdatasource-get.md
+
+ Title: "Get ediscoveryNoncustodialDataSource"
+description: "Read the properties and relationships of an ediscoveryNoncustodialDataSource object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryNoncustodialDataSource
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoverynoncustodialdatasource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043?$expand=dataSource
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryNoncustodialDataSource"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources(dataSource())/$entity",
+ "status": "active",
+ "holdStatus": "applied",
+ "createdDateTime": "2022-05-23T02:09:11.1395287Z",
+ "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
+ "releasedDateTime": "0001-01-01T00:00:00Z",
+ "id": "35393639323133394345384344303043",
+ "displayName": "U.S. Sales",
+ "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('35393639323133394345384344303043')/dataSource/$entity",
+ "dataSource": {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "displayName": "U.S. Sales",
+ "createdDateTime": "2022-05-23T02:09:11.1395535Z",
+ "holdStatus": "0",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ },
+ "site": {
+ "webUrl": "https://m365x809305.sharepoint.com/sites/USSales",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdDateTime": "2022-05-23T02:09:11.1395535Z"
+ }
+ }
+}
+```
v1.0 Security Ediscoverynoncustodialdatasource Release https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverynoncustodialdatasource-release.md
+
+ Title: "ediscoveryNoncustodialDataSource: release"
+description: "Release the non-custodial data source from the case."
+
+ms.localizationpriority: medium
++
+# ediscoveryNoncustodialDataSource: release
+Namespace: microsoft.graph.security
+++
+Release the non-custodial data source from the case.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/release
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverynoncustodialdatasourcethis.release"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/release
+```
++
+### Response
+The following is an example of the response.
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
+
v1.0 Security Ediscoverynoncustodialdatasource Removehold https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverynoncustodialdatasource-removehold.md
+
+ Title: "ediscoveryNoncustodialDataSource: removeHold"
+description: "Start the process of removing hold from eDiscovery non-custodial data sources."
+
+ms.localizationpriority: medium
++
+# ediscoveryNoncustodialDataSource: removeHold
+Namespace: microsoft.graph.security
+++
+Start the process of removing hold from [eDiscovery non-custodial data sources](../resources/security-ediscoverynoncustodialdatasource.md). After the operation is created, you can get the status by retrieving the `Location` parameter from the response headers. The location provides a URL that will return an [eDiscoveryHoldOperation](../resources/security-ediscoveryholdoperation.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/removeHold
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoverynoncustodialDatasourceId}/removeHold
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the parameters.
+
+The following table shows the parameters that can be used with this action.
+
+|Parameter|Type|Description|
+|:|:|:|
+|ids|String collection|The IDs of non-custodial data sources to remove hold. Optional.|
+++
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Example 1: Remove hold from multiple non-custodial data sources
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.removehold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/removeHold
+Content-Type: application/json
+
+{
+ "ids": [
+ "39333641443238353535383731453339",
+ "46333131344239353834433430454335"
+ ]
+}
+```
++
+#### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
+
+### Example 2: Remove hold from a single non-custodial data source
+#### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverycustodianthis.removehold"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/39333641443238353535383731453339/removeHold
+```
++
+#### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoverynoncustodialdatasource Updateindex https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverynoncustodialdatasource-updateindex.md
+
+ Title: "ediscoveryNoncustodialDataSource: updateIndex"
+description: "Trigger an indexOperation to make a non-custodial data source and its associated data source searchable."
+
+ms.localizationpriority: medium
++
+# ediscoveryNoncustodialDataSource: updateIndex
+Namespace: microsoft.graph.security
+++
+Trigger an [indexOperation](../resources/security-ediscoveryIndexOperation.md) to make a non-custodial data source and its associated data source searchable.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
++
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/updateIndex
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this action returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverynoncustodialdatasourcethis.updateindex"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/46333131344239353834433430454335/updateIndex
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
+
v1.0 Security Ediscoveryreviewset Addtoreviewset https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewset-addtoreviewset.md
+
+ Title: "ediscoveryReviewSet: addToReviewSet"
+description: "Start the process of adding a collection from Microsoft 365 services to a review set."
+
+ms.localizationpriority: medium
++
+# ediscoveryReviewSet: addToReviewSet
+Namespace: microsoft.graph.security
+++
+Start the process of adding a collection from Microsoft 365 services to a [review set](../resources/security-ediscoveryreviewset.md). After the operation is created, you can get the status of the operation by retrieving the `Location` parameter from the response headers. The location provides a URL that will return a [Add to review set operation](../resources/security-ediscoveryaddtoreviewsetoperation.md).
++
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoverycases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the parameters.
+
+The following table shows the parameters that can be used with this action.
+
+|Parameter|Type|Description|
+|:|:|:|
+|search|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|The ID of the eDiscovery search you'd like to add to the review set.|
+|additionalDataOptions|additionalDataOptions|The options for adding items to reviewSet.|
+
+### additionalDataOptions values
+|Name|Description|
+|:|:|
+|allVersions|include all versions of a sharepoint document matching the source collection query. Caution: SharePoint versions can significantly increase the volume of items |
+|linkedFiles|include linked files that were shared in outlook, teams, or yammer messages by attaching a link to the file.|
+
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoveryreviewsetthis.addtoreviewset"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/addToReviewSet
+Content-Type: application/json
+
+{
+ "search": {
+ "id": "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
+ },
+ "additionalDataOptions": "linkedFiles"
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoveryreviewset Delete Queries https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewset-delete-queries.md
+
+ Title: "Delete ediscoveryReviewSetQuery"
+description: "Delete an ediscoveryReviewSetQuery object."
+
+ms.localizationpriority: medium
++
+# Delete ediscoveryReviewSetQuery
+Namespace: microsoft.graph.security
+++
+Delete an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+DELETE /security/cases/ediscoverycases/{eDiscoveryCaseId}}/reviewSets/{ediscoveryReviewSetId}/queries/{eDiscoveryReviewSetQueryId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "delete_ediscoveryreviewsetquery"
+}
+-->
+``` http
+DELETE https://graph.microsoft.com/v1.0/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/queries/b7f4961d-59b1-444f-a4ec-57f2e5c2bf21
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
+
v1.0 Security Ediscoveryreviewset Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewset-get.md
+
+ Title: "Get ediscoveryReviewSet"
+description: "Read the properties and relationships of an ediscoveryReviewSet object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryReviewSet
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /ediscoveryExportOperation/reviewSet
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoveryreviewset"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/273f11a1-17aa-419c-981d-ff10d33e420f
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewSet"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/reviewSets/$entity",
+ "displayName": "Teams messages",
+ "id": "273f11a1-17aa-419c-981d-ff10d33e420f",
+ "createdDateTime": "2022-05-29T20:49:47.4133043Z",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoveryreviewset List Queries https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewset-list-queries.md
+
+ Title: "List queries"
+description: "Get the list of queries associated with an eDiscovery review set."
+
+ms.localizationpriority: medium
++
+# List queries
+Namespace: microsoft.graph.security
+++
+Get the list of [queries](../resources/security-ediscoveryreviewsetquery.md) associated with an eDiscovery review set.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoveryreviewsetquery"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/273f11a1-17aa-419c-981d-ff10d33e420f/queries
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoveryReviewSetQuery)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/reviewSets('273f11a1-17aa-419c-981d-ff10d33e420f')/queries",
+ "value": [
+ {
+ "lastModifiedDateTime": "2022-05-29T20:49:47.9289317Z",
+ "contentQuery": "((((FileClass=\"Email\") AND (InclusiveType=\"InclusiveMinus\" OR InclusiveType=\"Inclusive\")) OR ((FileClass=\"Attachment\") AND (UniqueInEmailSet=\"true\")) OR ((FileClass=\"Document\") AND (MarkAsRepresentative=\"Unique\")) OR ((FileClass=\"Conversation\"))))",
+ "id": "837335b0-1943-444d-a3d1-5522cc21c5a4",
+ "displayName": "[AutoGen] For Review",
+ "createdDateTime": "2022-05-29T20:49:47.9289317Z",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ },
+ "lastModifiedBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ },
+ {
+ "lastModifiedDateTime": "2022-05-29T20:49:48.0539099Z",
+ "contentQuery": "((FileType:gz OR FileType:gzip OR FileType:bz2 OR FileType:zip OR FileType:7z OR FileType:rar OR FileType:vhd OR FileType:mbox OR FileType:pst OR FileType:sfx) OR (Size<\"3072B\" AND (FileType:gif OR FileType:bmp OR FileType:png OR FileType:jpg OR FileType:jpeg OR FileType:tif OR FileType:tiff OR FileType:emf OR FileType:pct OR FileType:pic)))",
+ "id": "977ad4d5-3e5c-4594-8cb6-7d09dbcddf21",
+ "displayName": "[AutoGen] Potentially Immaterial Items",
+ "createdDateTime": "2022-05-29T20:49:48.0539099Z",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ },
+ "lastModifiedBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoveryreviewset Post Queries https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewset-post-queries.md
+
+ Title: "Create ediscoveryReviewSetQuery"
+description: "Create a new ediscoveryReviewSetQuery object."
+
+ms.localizationpriority: medium
++
+# Create ediscoveryReviewSetQuery
+Namespace: microsoft.graph.security
+++
+Create a new [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
+
+You can specify the following properties when you create an **ediscoveryReviewSetQuery**.
+
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|The name of the query. Required.|
+|contentQuery|String|The KQL query for the review set. For details, see [Query and filter content in a review set](/microsoft-365/compliance/review-set-search).|
+++
+## Response
+
+If successful, this method returns a `201 Created` response code and an [microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoveryreviewsetquery_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/273f11a1-17aa-419c-981d-ff10d33e420f/queries
+Content-Type: application/json
+
+{
+ "displayName": "My Query 1",
+ "contentQuery": "(Author=\"edison\")"
+}
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewSetQuery"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/reviewSets('273f11a1-17aa-419c-981d-ff10d33e420f')/queries/$entity",
+ "description": null,
+ "lastModifiedDateTime": "2022-05-29T23:39:51.3307953Z",
+ "contentQuery": "((Author=\"edison\"))",
+ "id": "fcb86cd1-50e0-427c-840e-ba6f087364e5",
+ "displayName": "My Query 1",
+ "createdDateTime": "2022-05-29T23:39:51.3307953Z",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null,
+ "userPrincipalName": "c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+ }
+ },
+ "lastModifiedBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null,
+ "userPrincipalName": "c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoveryreviewsetquery Applytags https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewsetquery-applytags.md
+
+ Title: "ediscoveryReviewSetQuery: applyTags"
+description: "Apply tags to files in an eDiscovery review set."
+
+ms.localizationpriority: medium
++
+# ediscoveryReviewSetQuery: applyTags
+Namespace: microsoft.graph.security
+++
+Apply tags to files in an [eDiscovery review set](../resources/security-ediscoveryreviewset.md). For details, see [Tag documents in a review set in eDiscovery](/microsoft-365/compliance/tagging-documents).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/applyTags
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the parameters.
+
+The following table shows the parameters that can be used with this action.
+
+|Parameter|Type|Description|
+|:|:|:|
+|tagsToAdd|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|Tags to remove from the files in review set query.|
+|tagsToRemove|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|Tags to remove add the files in review set query.|
+++
+## Response
+
+If successful, this action returns a `202 Accepted` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoveryreviewsetquerythis.applytags"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/queries/5f426fdc-f027-40db-b7cc-453cf06dc996/applyTags
+Content-Type: application/json
+
+{
+ "tagsToAdd": [
+ {"id": "d3d99dc704a74801b792b3e1e722aa0d"}
+ ]
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 202 Accepted
+```
v1.0 Security Ediscoveryreviewsetquery Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewsetquery-get.md
+
+ Title: "Get ediscoveryReviewSetQuery"
+description: "Read the properties and relationships of an ediscoveryReviewSetQuery object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryReviewSetQuery
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoveryreviewsetquery"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/273f11a1-17aa-419c-981d-ff10d33e420f/queries/fcb86cd1-50e0-427c-840e-ba6f087364e5
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewSetQuery"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/reviewSets('273f11a1-17aa-419c-981d-ff10d33e420f')/queries/$entity",
+ "description": null,
+ "lastModifiedDateTime": "2022-05-29T23:39:51.3307953Z",
+ "contentQuery": "((Author=\"edison\"))",
+ "id": "fcb86cd1-50e0-427c-840e-ba6f087364e5",
+ "displayName": "My Query 1",
+ "createdDateTime": "2022-05-29T23:39:51.3307953Z",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null,
+ "userPrincipalName": "c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+ }
+ },
+ "lastModifiedBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null,
+ "userPrincipalName": "c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoveryreviewsetquery Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewsetquery-update.md
+
+ Title: "Update ediscoveryReviewSetQuery"
+description: "Update the properties of an ediscoveryReviewSetQuery object."
+
+ms.localizationpriority: medium
+
+# Update ediscoveryReviewSetQuery
+Namespace: microsoft.graph.security
+++
+Update the properties of an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
++
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|The name of the query. Required.|
+|contentQuery|String|The KQL query for the review set. For details, see [Query and filter content in a review set](/microsoft-365/compliance/review-set-search).|
+++
+## Response
+
+If successful, this method returns a `204 No content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "update_ediscoveryreviewsetquery"
+}
+-->
+``` http
+PATCH https://graph.microsoft.com/v1.0/security/cases/ediscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/queries/5f426fdc-f027-40db-b7cc-453cf06dc996
+Content-Type: application/json
+
+{
+ "displayName": "My Query 1 (update)",
+ "contentQuery": "(Author=\"edisons\")"
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No content.
+```
v1.0 Security Ediscoveryreviewtag Ashierarchy https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewtag-ashierarchy.md
+
+ Title: "ediscoveryReviewTag: asHierarchy"
+description: "List tag as hierarchy*"
+
+ms.localizationpriority: medium
++
+# ediscoveryReviewTag: asHierarchy
+Namespace: microsoft.graph.security
+++
+List [eDiscovery review tags](../resources/security-ediscoveryreviewtag.md) with the tag hierarchy shown.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/asHierarchy
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this function returns a `200 OK` response code and a [microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoveryreviewtagthis.ashierarchy"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags/asHierarchy
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoveryReviewTag)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(ediscoveryReviewTag)",
+ "@odata.count": 5,
+ "value": [
+ {
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewTag",
+ "displayName": "My tag API 2",
+ "description": "Use Graph API to create tags (updated)",
+ "lastModifiedDateTime": "2022-05-30T00:27:41.6407249Z",
+ "childSelectability": "Many",
+ "id": "062de822f17a4a2e9b833aa3f6c37108",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ },
+ "childTags": []
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewTag",
+ "displayName": "Responsive",
+ "description": "",
+ "lastModifiedDateTime": "2022-05-23T19:41:24.4237284Z",
+ "childSelectability": "One",
+ "id": "d3d99dc704a74801b792b3e1e722aa0d",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ },
+ "childTags": []
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewTag",
+ "displayName": "Not responsive",
+ "lastModifiedDateTime": "2022-05-23T19:41:31.3381716Z",
+ "childSelectability": "One",
+ "id": "ced26633616a434abd83762d49a25a6c",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ },
+ "childTags": []
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewTag",
+ "displayName": "Processing",
+ "description": "Determine whether to outsource processing",
+ "lastModifiedDateTime": "2022-05-23T19:46:03.8746996Z",
+ "childSelectability": "Many",
+ "id": "d8580989505c4fb3a25b845013697cf7",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ },
+ "childTags": []
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewTag",
+ "displayName": "My tag API",
+ "description": "Use Graph API to create tags",
+ "lastModifiedDateTime": "2022-05-23T19:58:26.1573076Z",
+ "childSelectability": "Many",
+ "id": "7c6cc351-fb90-431f-8562-1b607a3144a4",
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
+ "displayName": "Graph Explorer"
+ }
+ },
+ "childTags": []
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoveryreviewtag Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewtag-get.md
+
+ Title: "Get ediscoveryReviewTag"
+description: "Read the properties and relationships of an ediscoveryReviewTag object."
+
+ms.localizationpriority: medium
++
+# Get ediscoveryReviewTag
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/parent
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}/tags/{ediscoveryReviewTagId}/childTags/{ediscoveryReviewTagId}
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoveryreviewtag"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags/062de822f17a4a2e9b833aa3f6c37108
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewTag"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/tags/$entity",
+ "displayName": "My tag",
+ "description": null,
+ "lastModifiedDateTime": "2022-05-23T19:41:01.7432683Z",
+ "childSelectability": "Many",
+ "id": "062de822f17a4a2e9b833aa3f6c37108",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ }
+ }
+}
+```
+
v1.0 Security Ediscoveryreviewtag Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoveryreviewtag-update.md
+
+ Title: "Update ediscoveryReviewTag"
+description: "Update the properties of an ediscoveryReviewTag object."
+
+ms.localizationpriority: medium
+++
+# Update ediscoveryReviewTag
+Namespace: microsoft.graph.security
+++
+Update the properties of an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+++
+|Property|Type|Description|
+|:|:|:|
+|displayName|String|Display name of the tag. Required.|
+|description|String|Description of the tag. Optional.|
+|childSelectability|microsoft.graph.security.childSelectability|This value controls whether the UX presents the tags as checkboxes or a radio button group. The possible values are: `One`, `Many`. Required.|
++
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "update_ediscoveryreviewtag"
+}
+-->
+``` http
+PATCH https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/tags/062de822f17a4a2e9b833aa3f6c37108
+
+{
+ "displayName": "My tag API 2",
+ "description": "Use Graph API to create tags (updated)"
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+
+```
+
v1.0 Security Ediscoverysearch Delete Custodiansources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-delete-custodiansources.md
+
+ Title: "Remove custodianSources"
+description: "Remove a dataSource object."
+
+ms.localizationpriority: medium
++
+# Remove custodianSources
+Namespace: microsoft.graph.security
+++
+Remove a [dataSource](../resources/security-datasource.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources/{id}/$ref
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "delete_custodiansources_from_ediscoverysearch"
+}
+-->
+``` http
+DELETE https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources/{id}/$ref
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverysearch Delete Noncustodialsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-delete-noncustodialsources.md
+
+ Title: "Remove noncustodialSources"
+description: "Remove an ediscoveryNoncustodialDataSource object."
+
+ms.localizationpriority: medium
++
+# Remove noncustodialSources
+Namespace: microsoft.graph.security
+++
+Remove an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+DELETE /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/noncustodialSources/{id}/$ref
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "delete_noncustodialsources_from_ediscoverysearch"
+}
+-->
+``` http
+DELETE https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/noncustodialSources/35393639323133394345384344303043/$ref
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
+
v1.0 Security Ediscoverysearch Estimatestatistics https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-estimatestatistics.md
+
+ Title: "ediscoverySearch: estimateStatistics"
+description: "Runs an estimate of the eDiscovery search."
+
+ms.localizationpriority: medium
++
+# ediscoverySearch: estimateStatistics
+Namespace: microsoft.graph.security
+
+Run an estimate of the number of emails and documents in the eDiscovery search. To learn more about searches in eDiscovery, see [Collect data for a case in eDiscovery (Premium)](/microsoft-365/compliance/collecting-data-for-ediscovery).
++
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/estimateStatistics
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If the estimate is started successfully, this action returns a `202 Accepted` response code.
+The response will also contain a `Location` header, which contains the location of the [microsoft.graph.security.estimateStatisticsOperation](../resources/security-ediscoveryestimateoperation.md) that was created to handle the estimate. Check the status of the estimate operation by making a GET request to the location.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "ediscoverysearchthis.estimatestatistics"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/estimatestatistics
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverysearch Get https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-get.md
+
+ Title: "Get ediscoverySearch"
+description: "Read the properties and relationships of an ediscoverySearch object."
+
+ms.localizationpriority: medium
++
+# Get ediscoverySearch
+Namespace: microsoft.graph.security
+++
+Read the properties and relationships of an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and an [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "get_ediscoverysearch"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/58399dff-cebe-478f-b1af-d3227f1fd645/searches/60150269-9758-4439-9bc4-453c864d082f
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoverySearch"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('58399dff-cebe-478f-b1af-d3227f1fd645')/searches/$entity",
+ "dataSourceScopes": "none",
+ "description": "",
+ "lastModifiedDateTime": "2022-03-17T22:24:22.5038229Z",
+ "contentQuery": "messagekind:microsoftteams ",
+ "id": "60150269-9758-4439-9bc4-453c864d082f",
+ "displayName": "loop only",
+ "createdDateTime": "2022-03-17T22:24:22.5038229Z",
+ "lastModifiedBy": null,
+ "createdBy": {
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": "MOD Administrator",
+ "userPrincipalName": "admin@M365x809305.onmicrosoft.com"
+ },
+ "application": {
+ "id": "80ccca67-54bd-44ab-8625-4b79c4dc7775",
+ "displayName": null
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverysearch List Additionalsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-list-additionalsources.md
+
+ Title: "List additionalSources"
+description: "Get the list of additional sources associated with an eDiscovery search."
+
+ms.localizationpriority: medium
++
+# List additionalSources
+Namespace: microsoft.graph.security
+++
+Get the list of [additional sources](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/additionalSources
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.dataSource](../resources/security-datasource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoverynoncustodialdatasource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/additionalSources
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoveryNoncustodialDataSource)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/searches('c61a5860-d634-4d14-aea7-d82b6f4eb7af')/additionalSources",
+ "value": [
+ {
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "displayName": null,
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "43434642-3137-3138-3432-374142313639",
+ "email": "AlexW@M365x809305.OnMicrosoft.com",
+ "includedSources": "mailbox",
+ "siteWebUrl": null,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "displayName": null,
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "38423145-4639-4244-4437-464630424139",
+ "email": "IrvinS@M365x809305.OnMicrosoft.com",
+ "includedSources": "mailbox",
+ "siteWebUrl": null,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "displayName": null,
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "36304536-3033-3845-4639-394538443235",
+ "email": "AllanD@M365x809305.OnMicrosoft.com",
+ "includedSources": "mailbox",
+ "siteWebUrl": null,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/",
+ "displayName": null,
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "46454445-3936-3941-4145-463642313642",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/",
+ "displayName": null,
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "37383041-3143-3731-3744-384643453341",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/",
+ "displayName": null,
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "30394337-4541-4632-4532-423832464235",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverysearch List Custodiansources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-list-custodiansources.md
+
+ Title: "List custodianSources"
+description: "Get the list of custodial data sources associated with an eDiscovery search."
+
+ms.localizationpriority: medium
++
+# List custodianSources
+Namespace: microsoft.graph.security
+++
+Get the list of custodial data sources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.dataSource](../resources/security-datasource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_datasource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/custodianSources
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.dataSource)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.security.dataSource)",
+ "value": [
+ {
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/cases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/userSources('c25c3914-f9f7-43ee-9cba-a25377e0cec6')",
+ "displayName": "MOD Administrator",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "email": "admin@M365x809305.onmicrosoft.com",
+ "includedSources": "mailbox,site",
+ "siteWebUrl": null,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/cases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/userSources('43434642-3137-3138-3432-374142313639')",
+ "displayName": "Alex Wilber",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "43434642-3137-3138-3432-374142313639",
+ "email": "AlexW@M365x809305.OnMicrosoft.com",
+ "includedSources": "mailbox,site",
+ "siteWebUrl": null,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.unifiedGroupSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/cases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')",
+ "displayName": "Design (Mailbox)",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "32e14fa4-3106-4bd2-a245-34bf0c718a7e",
+ "includedSources": "mailbox,site",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/cases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/siteSources('169718e3-a8df-449d-bef4-ee09fe1ddc5d')",
+ "displayName": "U.S. Sales",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ }
+ },
+ {
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/cases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('c25c3914f9f743ee9cbaa25377e0cec6')/userSources('45354430-3730-4232-4236-323230383438')",
+ "displayName": "MOD Administrator",
+ "createdDateTime": "0001-01-01T00:00:00Z",
+ "holdStatus": "0",
+ "id": "45354430-3730-4232-4236-323230383438",
+ "email": "admin@M365x809305.onmicrosoft.com",
+ "includedSources": "mailbox,site",
+ "siteWebUrl": null,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
+ "displayName": null
+ }
+ }
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverysearch List Lastestimatestatisticsoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-list-lastestimatestatisticsoperation.md
+
+ Title: "List lastEstimateStatisticsOperation"
+description: "Get the last ediscoveryEstimateOperation object and its properties."
+
+ms.localizationpriority: medium
++
+# List lastEstimateStatisticsOperation
+Namespace: microsoft.graph.security
+++
+Get the last [ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) objects and their properties.
+
+>**Note:** This method only lists the last operation; it does not return a history of all operations.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/lastEstimateStatisticsOperation
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a [microsoft.graph.security.ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoveryestimateoperation"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/lastEstimateStatisticsOperation
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.ediscoveryEstimateOperation"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.security.ediscoveryEstimateOperation",
+ "createdDateTime": "2022-05-29T18:56:48.4649404Z",
+ "completedDateTime": "2022-05-29T18:58:31.968065Z",
+ "percentProgress": 100,
+ "status": "succeeded",
+ "action": "estimateStatistics",
+ "id": "d80d2f2bc71d4544b75d4836bef4ff57",
+ "indexedItemCount": 1756,
+ "indexedItemsSize": 89489297,
+ "unindexedItemCount": 1,
+ "unindexedItemsSize": 57952,
+ "mailboxCount": 4,
+ "siteCount": 6,
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": "0d38933a-0bbd-41ca-9ebd-28c4b5ba7cb7",
+ "displayName": null,
+ "userPrincipalName": null
+ }
+ }
+}
+```
+
v1.0 Security Ediscoverysearch List Noncustodialsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-list-noncustodialsources.md
+
+ Title: "List noncustodialSources"
+description: "Get the list of noncustodialSources associated with an eDiscovery search."
+
+ms.localizationpriority: medium
++
+# List noncustodialSources
+Namespace: microsoft.graph.security
+++
+Get the list of noncustodialSources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+GET /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/noncustodialSources
+```
+
+## Optional query parameters
+This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+
+## Request body
+Do not supply a request body for this method.
+
+## Response
+
+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) objects in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "list_ediscoverynoncustodialdatasource"
+}
+-->
+``` http
+GET https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/noncustodialsources
+```
++
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "Collection(microsoft.graph.security.ediscoveryNoncustodialDataSource)"
+}
+-->
+``` http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.security.ediscoveryNoncustodialDataSource)",
+ "value": [
+ {
+ "status": "released",
+ "holdStatus": "removing",
+ "createdDateTime": "2022-05-23T02:09:11.1395287Z",
+ "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
+ "releasedDateTime": "2022-05-26T18:37:12.3318976Z",
+ "id": "35393639323133394345384344303043",
+ "displayName": "U.S. Sales"
+ }
+ ]
+}
+```
+
v1.0 Security Ediscoverysearch Post Additionalsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-post-additionalsources.md
+
+ Title: "Add additional sources"
+description: "Create a new additional source associated with an eDiscovery search."
+
+ms.localizationpriority: medium
++
+# Add additional sources
+Namespace: microsoft.graph.security
++
+Create a new [additional source](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/additionalSources
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [dataSource](../resources/security-datasource.md) object.
+
+You can specify the following properties when you create a **dataSource**.
+
+>**Note:** Either **email** or **site** is required, but not both.
+
+|Property|Type|Description|
+|:|:|:|
+|email|string|SMTP address of the mailbox. To get the email address of a group, use [List groups](../api/group-list.md) or [Get group](../api/group-get.md). You can query by the name of the group using `$filter`; for example, `https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'secret group'&$select=mail,id,displayName`.|
+|site|string|URL of the site; for example, `https://contoso.sharepoint.com/sites/HumanResources`. |
++
+## Response
+
+If successful, this method returns a `201 Created` and a [microsoft.graph.security.dataSource](../resources/security-ediscoverysearch.md) object in the response body.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_datasource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/additionalSources
+
+{
+ "@odata.type": "microsoft.graph.security.siteSource",
+ "site": {
+ "webUrl": "https://contoso.sharepoint.com/sites/SecretSite"
+ }
+}
+```
+
+### Response
+The following is an example of the response.
+>**Note:** The response object shown here might be shortened for readability.
+<!-- {
+ "blockType": "response",
+ "truncated": true,
+ "@odata.type": "microsoft.graph.security.dataSource"
+}
+-->
+``` http
+HTTP/1.1 201 Created
+
+{
+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/searches('c61a5860-d634-4d14-aea7-d82b6f4eb7af')/additionalSources/$entity",
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "@odata.id": "https://graph.microsoft.com/v1.0/sites/46303732-3434-4630-3832-363333363441",
+ "displayName": "Design - top secret",
+ "createdDateTime": "2022-07-15T22:45:36.1096267Z",
+ "holdStatus": "0",
+ "id": "46303732-3434-4630-3832-363333363441",
+ "createdBy": {
+ "application": null,
+ "user": {
+ "id": null,
+ "displayName": null
+ }
+ }
+}
+```
v1.0 Security Ediscoverysearch Post Custodiansources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-post-custodiansources.md
+
+ Title: "Add custodian sources"
+description: "Create a new custodian source associated with an eDiscovery search."
+
+ms.localizationpriority: medium
+++
+# Add custodian sources
+Namespace: microsoft.graph.security
+++
+Create a new custodian source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources/$ref
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [dataSource](../resources/security-datasource.md) object.
+
+You can specify the following properties when you create a **dataSource**.
+
+|Property|Type|Description|
+|:|:|:|
+|@odata.id|String|String that defines the custodial object. See [the example](#examples) that follows.|
+++
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_datasource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/custodianSources/$ref
+Content-Type: application/json
+
+{
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/c25c3914-f9f7-43ee-9cba-a25377e0cec6"
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverysearch Post Noncustodialsources https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-post-noncustodialsources.md
+
+ Title: "Add noncustodialDataSources"
+description: "Create a new non-custodial source associated with an eDiscovery search."
+
+ms.localizationpriority: medium
+++
+# Add noncustodialDataSources
+Namespace: microsoft.graph.security
+++
+Create a new non-custodial source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/noncustodialSources/$ref
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+In the request body, supply a JSON representation of the [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.
+
+You can specify the following properties when you create an **ediscoveryNoncustodialDataSource**.
+
+|Property|Type|Description|
+|:|:|:|
+|@odata.id|String|String that defines the non-custodial object. See the example that follows.|
++
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "create_ediscoverynoncustodialdatasource_from_"
+}
+-->
+``` http
+POST https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches/c61a5860-d634-4d14-aea7-d82b6f4eb7af/noncustodialSources/$ref
+Content-Type: application/json
+
+{
+ "@odata.id": "https://graph.microsoft.com/v1.0/security/cases/eDiscoverycases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialDataSources/39333641443238353535383731453339"
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Ediscoverysearch Update https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/api/security-ediscoverysearch-update.md
+
+ Title: "Update ediscoverySearch"
+description: "Update the properties of an ediscoverySearch object."
+
+ms.localizationpriority: medium
++
+# Update ediscoverySearch
+Namespace: microsoft.graph.security
+++
+Update the properties of an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.
+
+## Permissions
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
+
+|Permission type|Permissions (from least to most privileged)|
+|:|:|
+|Delegated (work or school account)|eDiscovery.Read.All, eDiscovery.ReadWrite.All|
+|Delegated (personal Microsoft account)|Not supported.|
+|Application|Not supported.|
+
+## HTTP request
+
+<!-- {
+ "blockType": "ignored"
+}
+-->
+``` http
+PATCH /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
+```
+
+## Request headers
+|Name|Description|
+|:|:|
+|Authorization|Bearer {token}. Required.|
+|Content-Type|application/json. Required.|
+
+## Request body
+++
+|Property|Type|Description|
+|:|:|:|
+|contentQuery|String|The query string in KQL (Keyword Query Language) query. For details, see [Keyword queries and search conditions for Content Search and eDiscovery](/microsoft-365/compliance/keyword-queries-and-search-conditions). You can refine searches by using fields paired with values; for example, `subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016`.|
+|dataSourceScopes|microsoft.graph.security.dataSourceScopes|When specified, the collection will span across a service for an entire workload. Possible values are: `none`,`allTenantMailboxes`,`allTenantSites`,`allCaseCustodians`,`allCaseNoncustodialDataSources`. **Note:** Either one custodian or specifying dataSourceScope is required when you create a source collection.|
+|description|String|The description of the **eDiscovery search**.|
+|displayName|String|The display name of the **eDiscovery search**.|
++
+## Response
+
+If successful, this method returns a `204 No Content` response code.
+
+## Examples
+
+### Request
+The following is an example of a request.
+<!-- {
+ "blockType": "request",
+ "name": "update_ediscoverysearch"
+}
+-->
+``` http
+PATCH https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}
+Content-Type: application/json
+
+{
+ "displayName": "Teams search"
+}
+```
++
+### Response
+The following is an example of the response.
+
+<!-- {
+ "blockType": "response",
+ "truncated": true
+}
+-->
+``` http
+HTTP/1.1 204 No Content
+```
v1.0 Security Api Overview https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-api-overview.md
Alerts from the following providers are available via the Microsoft Graph Securi
\*\*\* Microsoft Defender for Identity alerts are available via the Microsoft Defender for Cloud Apps integration. This means you will get Microsoft Defender for Identity alerts only if you have joined Unified SecOps and connected Microsoft Defender for Identity into Microsoft Defender for Cloud Apps. Learn more about [how to integrate Microsoft Defender for Identity and Microsoft Defender for Cloud Apps](/defender-for-identity/mcas-integration).
+## eDiscovery
+
+[Microsoft Purview eDiscovery (Premium)](/microsoft-365/compliance/overview-ediscovery-20) provides an end-to-end workflow to preserve, collect, analyze, review, and export content that's responsive to your organization's internal and external investigations.
+ ## Information protection The Microsoft Graph threat assessment API helps organizations to assess the threat received by any user in a tenant. This empowers customers to report spam emails, phishing URLs or malware attachments they receive to Microsoft. The policy check result and rescan result can help tenant administrators understand the threat scanning verdict and adjust their organizational policy.
The following are some of the most popular requests for working with the Microso
|:|:--|:-| | List alerts | [List alerts](../api/alert-list.md) | [https://graph.microsoft.com/v1.0/security/alerts](https://developer.microsoft.com/graph/graph-explorer?request=security/alerts&method=GET&version=v1.0&GraphUrl=https://graph.microsoft.com) | | Update alerts | [Update alert](../api/alert-update.md) | [https://graph.microsoft.com/v1.0/security/alerts/{alert-id}](https://developer.microsoft.com/graph/graph-explorer?request=security/alerts/{alert-id}&method=PATCH&version=v1.0&GraphUrl=https://graph.microsoft.com) |
+|List eDiscovery cases|[List eDiscoveryCases](../api/security-casesroot-list-ediscoverycases.md)|[https://graph.microsoft.com/beta/security/cases/eDiscoveryCases](https://developer.microsoft.com/graph/graph-explorer?request=security%2Fcases%2FeDiscoverycases&method=GET&version=v1.0&GraphUrl=https://graph.microsoft.com)|
+|List eDiscovery case operations|[List caseOperations](../api/security-ediscoverycase-list-operations.md)|[https://graph.microsoft.com/beta/security/cases/eDiscoverycases/{id}/operations](https://developer.microsoft.com/graph/graph-explorer?request=security%2Fcases%2FeDiscoverycases%2F%7Bid%7D%2Foperations&method=GET&version=v1.0&GraphUrl=https://graph.microsoft.com)|
|List secure scores|[List secureScores](../api/security-list-securescores.md) |[https://graph.microsoft.com/v1.0/security/secureScores](https://developer.microsoft.com/graph/graph-explorer?request=security/secureScores&method=GET&version=v1.0&GraphUrl=https://graph.microsoft.com)| |Get secure score|[Get secureScore](../api/securescore-get.md) |[https://graph.microsoft.com/v1.0/security/secureScores/{id}](https://developer.microsoft.com/graph/graph-explorer?request=security/secureScores/{id}&method=GET&version=v1.0&GraphUrl=https://graph.microsoft.com)| |List secure score control profiles|[List secureScoreControlProfiles](../api/security-list-securescorecontrolprofiles.md) |[https://graph.microsoft.com/v1.0/security/secureScoreControlProfiles](https://developer.microsoft.com/graph/graph-explorer?request=security/secureScoreControlProfiles&method=GET&version=v1.0&GraphUrl=https://graph.microsoft.com)|
v1.0 Security Caseoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-caseoperation.md
+
+ Title: "caseOperation resource type"
+description: "An abstract entity that represents a long-running process."
+
+ms.localizationpriority: medium
++
+# caseOperation resource type
+
+Namespace: microsoft.graph.security
+++
+Inherits from [entity](../resources/entity.md).
+
+An abstract entity that represents a long-running eDiscovery process. It contains a common set of properties that are shared among inheriting entities. Entities that derive from **caseOperation** include:
+
+- [Index operation](../resources/security-ediscoveryindexoperation.md)
+- [Hold operation](../resources/security-ediscoveryholdoperation.md)
+- [Estimate operation](../resources/security-ediscoveryestimateoperation.md)
+- [Add to review set operation](../resources/security-ediscoveryaddtoreviewsetoperation.md)
+- [Tag operation](../resources/security-ediscoverytagoperation.md)
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List caseOperations](../api/security-ediscoverycase-list-operations.md)|[microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) collection|Get a list of the [caseOperation](../resources/security-caseoperation.md) objects and their properties.|
+|[Get caseOperation](../api/security-caseoperation-get.md)|[microsoft.graph.security.caseOperation](../resources/security-caseoperation.md)|Read the properties and relationships of a [caseOperation](../resources/security-caseoperation.md) object.|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|action|[microsoft.graph.security.caseAction](../resources/security-caseoperation.md#caseaction-values)| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|completedDateTime|DateTimeOffset| The date and time the operation was completed. |
+|createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. |
+|createdDateTime|DateTimeOffset| The date and time the operation was created. |
+|id|String| The ID for the operation. Read-only. |
+|percentProgress|Int32| The progress of the operation. |
+|resultInfo|[resultInfo](../resources/resultinfo.md)| Contains success and failure-specific result information. |
+|status|[microsoft.graph.security.caseOperationStatus](../resources/security-caseoperation.md#caseoperationstatus-values)| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+
+### caseAction values
+
+|Member|Description|
+|:-|--|
+| addToReviewSet | The operation represents adding data to a review set from an eDiscovery collection. |
+| applyTags | The operation represents bulk tagging documents in a review set for the specified review set query. |
+| contentExport | The operation represents a content export from a review set. |
+| convertToPdf | The operation represents converting documents to PDFs with redactions. |
+| estimateStatistics | The operation represents searching against Microsoft 365 services such as Exchange, SharePoint, and OneDrive for business. |
+| holdUpdate | The operation represent updating legal hold (apply/remove) for custodians and non-custodial data sources.
+| index | The operation represents indexing data sources of custodians and non-custodial data sources to make them searchable. |
+| purgeData | The operation represents purging content from the source workloads. |
+
+### caseOperationStatus values
+
+|Member|Description|
+|:-|--|
+| notStarted | The operation has not yet started. |
+| submissionFailed | Submission of the operation failed. |
+| running | The operation is currently running. |
+| succeeded | The operation was successfully completed without any errors. |
+| partiallySucceeded | The operation completed, but there were errors. For error details, see [resultInfo](../resources/resultinfo.md). |
+| failed | The operation failed. For error details, see [resultInfo](../resources/resultinfo.md). |
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.caseOperation",
+ "baseType": "microsoft.graph.entity",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.caseOperation",
+ "id": "String (identifier)",
+ "createdDateTime": "String (timestamp)",
+ "completedDateTime": "String (timestamp)",
+ "action": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "percentProgress": "Integer",
+ "status": "String",
+ "resultInfo": {
+ "@odata.type": "microsoft.graph.resultInfo"
+ }
+}
+```
v1.0 Security Datasource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-datasource.md
+
+ Title: "dataSource resource type"
+description: "The dataSource entity is an abstract base class used to identify sources of content for eDiscovery."
+
+ms.localizationpriority: medium
++
+# dataSource resource type
+
+Namespace: microsoft.graph.security
+++
+The dataSource entity is an abstract base class used to identify sources of content for eDiscovery.
+
+## Methods
+
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the **dataSource**.|
+|createdDateTime|DateTimeOffset|The date and time the **dataSource** was created.|
+|displayName|String|The display name of the **dataSource**. This will be the name of the SharePoint site.|
+|id|String| The ID of the **dataSource**. This is not the ID of the actual site.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **dataSource**.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.dataSource",
+ "baseType": "microsoft.graph.entity",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.dataSource",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "holdStatus": "String",
+ "createdDateTime": "String (timestamp)",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ }
+}
+```
+
v1.0 Security Datasourcecontainer https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-datasourcecontainer.md
+
+ Title: "dataSourceContainer resource type"
+description: "Base class for custodians and non-custodial data sources."
+
+ms.localizationpriority: medium
++
+# dataSourceContainer resource type
+
+Namespace: microsoft.graph.security
+++
+Base class for the [eDiscoveryCustodian](../resources/security-ediscoverycustodian.md) and [eDiscoveryNonCutodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) resources.
+
+This is an abstract type.
+
+Inherits from [entity](../resources/entity.md).
+
+## Methods
+
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the dataSourceContainer. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+|createdDateTime|DateTimeOffset|Created date and time of the dataSourceContainer entity.|
+|displayName|String|Display name of the dataSourceContainer entity.|
+|id|String|Unique identifier of the dataSourceContainer. Inherited from [entity](../resources/entity.md)|
+|lastModifiedDateTime|DateTimeOffset|Last modified date and time of the dataSourceContainer.|
+|releasedDateTime|DateTimeOffset|Date and time that the dataSourceContainer was released from the case.|
+|status|microsoft.graph.security.dataSourceContainerStatus|Latest status of the dataSourceContainer. Possible values are: `Active`, `Released`.|
+
+### dataSourceContainerStatus values
+
+|Member|Description|
+|:-|--|
+| active| Data source container is active.|
+| release | Data source container has been released.|
+
+### dataSourceHoldStatus values
+
+|Member|Description|
+|:-|--|
+| notApplied | Data source container is not on hold.|
+| applied | Data source container is on hold.|
+| applying | Data source container is in applying hold state (applyHold operation triggered).|
+| removing | Data source container is in removing the hold state (removeHold operation triggered).|
+| partial | Data source container is in mixed state where some sources are on hold and some not on hold or error state.|
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.dataSourceContainer",
+ "baseType": "microsoft.graph.entity",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.dataSourceContainer",
+ "id": "String (identifier)",
+ "status": "String",
+ "holdStatus": "String",
+ "lastModifiedDateTime": "String (timestamp)",
+ "releasedDateTime": "String (timestamp)",
+ "displayName": "String",
+ "createdDateTime": "String (timestamp)"
+}
+```
+
v1.0 Security Ediscoveryaddtoreviewsetoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryaddtoreviewsetoperation.md
+
+ Title: "ediscoveryAddToReviewSetOperation resource type"
+description: "Represents an operation to add an eDiscoverySearch to an eDiscoveryReviewSet."
+
+ms.localizationpriority: medium
++
+# ediscoveryAddToReviewSetOperation resource type
+
+Namespace: microsoft.graph.security
+++
+Represents an operation to add an [eDiscoverySearch](../resources/security-ediscoverysearch.md) to an [eDiscoveryReviewSet](../resources/security-ediscoveryreviewset.md).
+
+Inherits from [caseOperation](../resources/security-caseoperation.md).
+
+## Methods
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|action|microsoft.graph.security.caseAction| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|completedDateTime|DateTimeOffset| The date and time the operation was completed. |
+|createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. |
+|createdDateTime|DateTimeOffset| The date and time the operation was created. |
+|id|String| The ID for the operation. Read-only. |
+|percentProgress|Int32| The progress of the operation. |
+|resultInfo|[resultInfo](../resources/resultinfo.md)| Contains success and failure-specific result information. |
+|status|microsoft.graph.security.caseOperationStatus| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|reviewSet|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md)|eDiscovery review set to which items matching source collection query gets added.|
+|search|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|eDiscovery search that gets added to review set.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryAddToReviewSetOperation",
+ "baseType": "microsoft.graph.security.caseOperation",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryAddToReviewSetOperation",
+ "id": "String (identifier)",
+ "createdDateTime": "String (timestamp)",
+ "completedDateTime": "String (timestamp)",
+ "action": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "percentProgress": "Integer",
+ "status": "String",
+ "resultInfo": {
+ "@odata.type": "microsoft.graph.resultInfo"
+ }
+}
+```
+
v1.0 Security Ediscoverycase https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoverycase.md
+
+ Title: "ediscoveryCase resource type"
+description: "In the context of eDiscovery, contains custodians, holds, collections, and review sets."
+
+ms.localizationpriority: medium
++
+# ediscoveryCase resource type
+
+Namespace: microsoft.graph.security
+++
+In the context of eDiscovery, contains custodians, searches, review sets. For details, see [Overview of Microsoft Purview eDiscovery (Premium)](/microsoft-365/compliance/overview-ediscovery-20).
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoveryCases](../api/security-casesroot-list-ediscoverycases.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md) collection|Get a list of the [ediscoveryCase](../resources/security-ediscoverycase.md) objects and their properties.|
+|[Create ediscoveryCase](../api/security-casesroot-post-ediscoverycases.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md)|Create a new [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
+|[Get ediscoveryCase](../api/security-ediscoverycase-get.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md)|Read the properties and relationships of an [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
+|[Update ediscoveryCase](../api/security-ediscoverycase-update.md)|[microsoft.graph.security.ediscoveryCase](../resources/security-ediscoverycase.md)|Update the properties of an [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
+|[Delete ediscoveryCase](../api/security-casesroot-delete-ediscoverycases.md)|None|Delete an [ediscoveryCase](../resources/security-ediscoverycase.md) object.|
+|[List custodians](../api/security-ediscoverycase-list-custodians.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) collection|Get the ediscoveryCustodian resources from the custodians navigation property.|
+|[Create ediscoveryCustodian](../api/security-ediscoverycase-post-custodians.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md)|Create a new ediscoveryCustodian object.|
+|[List noncustodialDataSources](../api/security-ediscoverysearch-list-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|Get the ediscoveryNoncustodialDataSource resources from the noncustodialDataSources navigation property.|
+|[Create ediscoveryNoncustodialDataSource](../api/security-ediscoverycase-post-noncustodialdatasources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md)|Create a new ediscoveryNoncustodialDataSource object.|
+|[List operations](../api/security-ediscoverycase-list-operations.md)|[microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) collection|Get the caseOperation resources from the operations navigation property.|
+|[List reviewSets](../api/security-ediscoverycase-list-reviewsets.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) collection|Get the ediscoveryReviewSet resources from the reviewSets navigation property.|
+|[Create ediscoveryReviewSet](../api/security-ediscoverycase-post-reviewsets.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md)|Create a new ediscoveryReviewSet object.|
+|[List searches](../api/security-ediscoverycase-list-searches.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) collection|Get the ediscoverySearch resources from the searches navigation property.|
+|[Create ediscoverySearch](../api/security-ediscoverycase-post-searches.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Create a new ediscoverySearch object.|
+|[List tags](../api/security-ediscoverycase-list-tags.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|Get the ediscoveryReviewTag resources from the tags navigation property.|
+|[Create ediscoveryReviewTag](../api/security-ediscoverycase-post-tags.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Create a new ediscoveryReviewTag object.|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|closedBy|[microsoft.graph.identitySet](../resources/identityset.md)|The user who closed the case.|
+|closedDateTime|DateTimeOffset|The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
+|createdBy|[microsoft.graph.identitySet](/graph/api/resources/identityset)|The user who created the case.|
+|createdDateTime|DateTimeOffset|The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
+|description|String|The case description.|
+|displayName|String|The case name.|
+|externalId|String|The external case number for customer reference.|
+|id|String|The ID for the eDiscovery case. Read-only. |
+|lastModifiedBy|[microsoft.graph.identitySet](../resources/identityset.md)|The last user who modified the case.
+|lastModifiedDateTime|DateTimeOffset|The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
+|status|microsoft.graph.security.caseStatus|The case status. Possible values are `unknown`, `active`, `pendingDelete`, `closing`, `closed`, and `closedWithError`. For details, see the following table.
+
+### caseStatus values
+
+|Member|Description|
+|:-|--|
+| unknown | Case status is unknown. |
+| active | Case is active. |
+| pendingDelete | Case was deleted, but the delete has not been fully transacted. |
+| closing | Case was closed, but the operation has not been fully transacted. |
+| closed | The case is closed. |
+| closedWithError | The case is closed, but there were errors releasing holds in the case. |
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|custodians|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) collection|Returns a list of case **ediscoveryCustodian** objects for this **case**.|
+|noncustodialDataSources|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|Returns a list of case **ediscoveryNoncustodialDataSource** objects for this **case**.|
+|operations|[microsoft.graph.security.caseOperation](../resources/security-caseoperation.md) collection|Returns a list of case **caseOperation** objects for this **case**.|
+|reviewSets|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) collection|Returns a list of **eDiscoveryReviewSet** objects in the case.|
+|searches|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) collection|Returns a list of **eDiscoverySearch** objects associated with this case.|
+|settings|[microsoft.graph.security.ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md)|Returns a list of **eDIscoverySettings** objects in the case.|
+|tags|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|Returns a list of **ediscoveryReviewTag** objects associated to this case.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryCase",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryCase",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "description": "String",
+ "createdDateTime": "String (timestamp)",
+ "lastModifiedBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "lastModifiedDateTime": "String (timestamp)",
+ "status": "String",
+ "closedBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "closedDateTime": "String (timestamp)",
+ "externalId": "String"
+}
+```
+
v1.0 Security Ediscoverycasesettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoverycasesettings.md
+
+ Title: "ediscoveryCaseSettings resource type"
+description: "Contains settings for an eDiscovery case."
+
+ms.localizationpriority: medium
++
+# ediscoveryCaseSettings resource type
+
+Namespace: microsoft.graph.security
+++
+Contains settings for an eDiscovery case. For details, see [Configure search and analytics settings in eDiscovery (Premium)](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery).
+
+Inherits from [entity](../resources/entity.md).
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[Get ediscoveryCaseSettings](../api/security-ediscoverycasesettings-get.md)|[microsoft.graph.security.ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md)|Read the properties and relationships of an [ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object.|
+|[Update ediscoveryCaseSettings](../api/security-ediscoverycasesettings-update.md)|[microsoft.graph.security.ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md)|Update the properties of an [ediscoveryCaseSettings](../resources/security-ediscoverycasesettings.md) object.|
+|[resetToDefault](../api/security-ediscoverycasesettings-resettodefault.md)|None|Reset all settings to the default values.|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|id|String|The ID of the eDiscovery case. Inherited from [entity](../resources/entity.md).|
+|ocr|[microsoft.graph.security.ocrSettings](../resources/security-ocrsettings.md)|The OCR (Optical Character Recognition) settings for the case.|
+|redundancyDetection|[microsoft.graph.security.redundancyDetectionSettings](../resources/security-redundancydetectionsettings.md)|The redundancy (near duplicate and email threading) detection settings for the case.|
+|topicModeling|[microsoft.graph.security.topicModelingSettings](../resources/security-topicmodelingsettings.md)|The Topic Modeling (Themes) settings for the case.|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryCaseSettings",
+ "baseType": "microsoft.graph.entity",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryCaseSettings",
+ "id": "String (identifier)",
+ "redundancyDetection": {
+ "@odata.type": "microsoft.graph.security.redundancyDetectionSettings"
+ },
+ "topicModeling": {
+ "@odata.type": "microsoft.graph.security.topicModelingSettings"
+ },
+ "ocr": {
+ "@odata.type": "microsoft.graph.security.ocrSettings"
+ }
+}
+```
+
v1.0 Security Ediscoverycustodian https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoverycustodian.md
+
+ Title: "ediscoveryCustodian resource type"
+description: "In the context of eDiscovery, represents a user and all of their digital assets, such as email and documents."
+
+ms.localizationpriority: medium
++
+# ediscoveryCustodian resource type
+
+Namespace: microsoft.graph.security
+++
+In the context of eDiscovery, represents a user and all of their digital assets, such as email and documents.
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoveryCustodians](../api/security-ediscoverycase-list-custodians.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md) collection|Get a list of the [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) objects and their properties.|
+|[Create ediscoveryCustodian](../api/security-ediscoverycase-post-custodians.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md)|Create a new [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object.|
+|[Get ediscoveryCustodian](../api/security-ediscoverycustodian-get.md)|[microsoft.graph.security.ediscoveryCustodian](../resources/security-ediscoverycustodian.md)|Read the properties and relationships of an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md) object.|
+|[updateIndex](../api/security-ediscoverycustodian-updateindex.md)|Triggers a indexOperation to make a custodian and associated sources searchable.|
+|[activate](../api/security-ediscoverycustodian-activate.md)|None|Re-activate a custodian from a case.|
+|[release](../api/security-ediscoverycustodian-release.md)|None|Release a custodian from a case.|
+|[applyHold](../api/security-ediscoverycustodian-applyhold.md)|None|Start the process of applying hold to eDiscovery custodians.|
+|[removeHold](../api/security-ediscoverycustodian-removehold.md)|None|Start the process of removing hold from eDiscovery custodians.|
+|[List ediscoveryIndexOperation](../api/security-ediscoverycustodian-list-lastindexoperation.md)|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) collection|Get a list of the [ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) associated with an [ediscoveryCustodian](../resources/security-ediscoverycustodian.md).|
+|[List siteSources](../api/security-ediscoverycustodian-list-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|Get the siteSource resources from the siteSources navigation property.|
+|[Create siteSource](../api/security-ediscoverycustodian-post-sitesources.md)|[microsoft.graph.security.siteSource](../resources/security-sitesource.md)|Create a new [siteSource](../resources/security-sitesource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).|
+|[List unifiedGroupSources](../api/security-ediscoverycustodian-list-unifiedgroupsources.md)|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) collection|Get the unifiedGroupSource resources from the unifiedGroupSources navigation property.|
+|[Create unifiedGroupSource](../api/security-ediscoverycustodian-post-unifiedgroupsources.md)|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md)|Create a new [unifiedGroupSource](../resources/security-unifiedgroupsource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).|
+|[List userSources](../api/security-ediscoverycustodian-list-usersources.md)|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Get the userSource resources from the userSources navigation property.|
+|[Create userSource](../api/security-ediscoverycustodian-post-usersources.md)|[microsoft.graph.security.userSource](../resources/security-usersource.md)|Create a new [userSource](../resources/security-usersource.md) object associated with an [eDiscovery custodian](../resources/security-ediscoverycustodian.md).|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|acknowledgedDateTime|DateTimeOffset|Date and time the custodian acknowledged a hold notification.|
+|createdDateTime|DateTimeOffset|Date and time when the custodian was added to the case.|
+|displayName|String|Display name of the custodian.|
+|email|String|Email address of the custodian.|
+|id|String|The ID for the custodian in the specified case. Read-only.|
+|lastModifiedDateTime|DateTimeOffset|Date and time the custodian object was last modified|
+|releasedDateTime|DateTimeOffset|Date and time the custodian was released from the case.|
+|status|microsoft.graph.security.custodianStatus|Status of the custodian. Possible values are: `active`, `released`.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the custodian.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+
+### custodianStatus values
+
+|Name|Description|
+|:-|--|
+|active|Custodian is an active part of the case. |
+|released|Custodian is released from the case.|
+
+### custodianHoldStatus values
+
+|Name|Description|
+|:-|--|
+|notApplied|The custodian is not on Hold (all sources in it are not on hold).|
+|applied|The custodian is on Hold (all sources are on hold).|
+|applying|The custodian is in applying hold state (applyHold operation triggered).|
+|removing|The custodian is in removing the hold state(removeHold operation triggered).|
+|partial|The custodian is in mixed state where some sources are on hold and some not on hold or error state.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|lastIndexOperation|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md)|Operation entity that represents the latest indexing for the custodian.|
+|siteSources|[microsoft.graph.security.siteSource](../resources/security-sitesource.md) collection|Data source entity for SharePoint sites associated with the custodian.|
+|unifiedGroupSources|[microsoft.graph.security.unifiedGroupSource](../resources/security-unifiedgroupsource.md) collection|Data source entity for groups associated with the custodian.|
+|userSources|[microsoft.graph.security.userSource](../resources/security-usersource.md) collection|Data source entity for a the custodian. This is the container for a custodian's mailbox and OneDrive for Business site.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryCustodian",
+ "baseType": "microsoft.graph.security.dataSourceContainer",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryCustodian",
+ "id": "String (identifier)",
+ "status": "String",
+ "holdStatus": "String",
+ "lastModifiedDateTime": "String (timestamp)",
+ "releasedDateTime": "String (timestamp)",
+ "displayName": "String",
+ "createdDateTime": "String (timestamp)",
+ "email": "String",
+ "acknowledgedDateTime": "String (timestamp)"
+}
+```
+
v1.0 Security Ediscoveryestimateoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryestimateoperation.md
+
+ Title: "ediscoveryEstimateOperation resource type"
+description: "Represents the process of estimating statistics (items count, size and number of locations) of an eDiscovery search."
+
+ms.localizationpriority: medium
++
+# ediscoveryEstimateOperation resource type
+
+Namespace: microsoft.graph.security
+++
+Represents the process of estimating statistics (items count, size and number of locations) of an eDiscovery search.
+
+Inherits from [caseOperation](../resources/security-caseoperation.md).
+
+## Methods
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|action|microsoft.graph.security.caseAction| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|completedDateTime|DateTimeOffset|The date and time the operation was completed. Read-only. |
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the operation. Read-only. |
+|createdDateTime|DateTimeOffset|The date and time the operation was started. Read-only.|
+|id|String| The ID for the operation. Read-only.|
+|indexedItemCount|Int64|The estimated count of items for the **search** that matched the content query.|
+|indexedItemsSize|Int64|The estimated size of items for the **search** that matched the content query.|
+|mailboxCount|Int32|The number of mailboxes that had search hits.|
+|percentProgress|Int32|The progress of the operation. Read-only. |
+|resultInfo|[resultInfo](../resources/resultinfo.md)|Contains success and failure-specific result information. |
+|siteCount|Int32|The number of mailboxes that had search hits.|
+|status|microsoft.graph.security.caseOperationStatus| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+|unindexedItemCount|Int64|The estimated count of unindexed items for the collection.|
+|unindexedItemsSize|Int64|The estimated size of unindexed items for the collection.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|search|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|eDiscovery search.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryEstimateOperation",
+ "baseType": "microsoft.graph.security.caseOperation",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryEstimateOperation",
+ "id": "String (identifier)",
+ "createdDateTime": "String (timestamp)",
+ "completedDateTime": "String (timestamp)",
+ "action": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "percentProgress": "Integer",
+ "status": "String",
+ "resultInfo": {
+ "@odata.type": "microsoft.graph.resultInfo"
+ },
+ "indexedItemCount": "Integer",
+ "indexedItemsSize": "Integer",
+ "unindexedItemCount": "Integer",
+ "unindexedItemsSize": "Integer",
+ "mailboxCount": "Integer",
+ "siteCount": "Integer"
+}
+```
+
v1.0 Security Ediscoveryholdoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryholdoperation.md
+
+ Title: "ediscoveryHoldOperation resource type"
+description: "Represents the process of applying hold to data sources, including custodians and non-custodial data sources."
+
+ms.localizationpriority: medium
++
+# ediscoveryHoldOperation resource type
+
+Namespace: microsoft.graph.security
+++
+Represents the process of applying hold to data sources, including custodians and non-custodial data sources.
+
+Inherits from [caseOperation](../resources/security-caseoperation.md).
+
+## Methods
+
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|action|[microsoft.graph.security.caseAction](../resources/security-caseoperation.md#caseaction-values)| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|completedDateTime|DateTimeOffset| The date and time the operation was completed. |
+|createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. |
+|createdDateTime|DateTimeOffset| The date and time the operation was created. |
+|id|String| The ID for the operation. Read-only. |
+|percentProgress|Int32| The progress of the operation. |
+|resultInfo|[resultInfo](../resources/resultinfo.md)| Contains success and failure-specific result information. |
+|status|[microsoft.graph.security.caseOperationStatus](../resources/security-caseoperation.md#caseoperationstatus-values)| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryHoldOperation",
+ "baseType": "microsoft.graph.security.caseOperation",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryHoldOperation",
+ "id": "String (identifier)",
+ "createdDateTime": "String (timestamp)",
+ "completedDateTime": "String (timestamp)",
+ "action": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "percentProgress": "Integer",
+ "status": "String",
+ "resultInfo": {
+ "@odata.type": "microsoft.graph.resultInfo"
+ }
+}
+```
+
v1.0 Security Ediscoveryindexoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryindexoperation.md
+
+ Title: "ediscoveryIndexOperation resource type"
+description: "Represents the process of indexing data sources, including custodians and non-custodial data sources."
+
+ms.localizationpriority: medium
++
+# ediscoveryIndexOperation resource type
+
+Namespace: microsoft.graph.security
+++
+Represents the process of indexing data sources, including custodians and non-custodial data sources.
+
+Inherits from [caseOperation](../resources/security-caseoperation.md).
+
+## Methods
+
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|action|[microsoft.graph.security.caseAction](../resources/security-caseoperation.md#caseaction-values)| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`|
+|completedDateTime|DateTimeOffset| The date and time the operation was completed. |
+|createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. |
+|createdDateTime|DateTimeOffset| The date and time the operation was created. |
+|id|String| The ID for the operation. Read-only. |
+|percentProgress|Int32| The progress of the operation. |
+|resultInfo|[resultInfo](../resources/resultinfo.md)| Contains success and failure-specific result information. |
+|status|[microsoft.graph.security.caseOperationStatus](../resources/security-caseoperation.md#caseoperationstatus-values)| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryIndexOperation",
+ "baseType": "microsoft.graph.security.caseOperation",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryIndexOperation",
+ "id": "String (identifier)",
+ "createdDateTime": "String (timestamp)",
+ "completedDateTime": "String (timestamp)",
+ "action": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "percentProgress": "Integer",
+ "status": "String",
+ "resultInfo": {
+ "@odata.type": "microsoft.graph.resultInfo"
+ }
+}
+```
+
v1.0 Security Ediscoverynoncustodialdatasource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoverynoncustodialdatasource.md
+
+ Title: "ediscoveryNoncustodialDataSource resource type"
+description: "Non-custodial data sources lets you add data to a case without having to associate it to a custodian."
+
+ms.localizationpriority: medium
++
+# ediscoveryNoncustodialDataSource resource type
+
+Namespace: microsoft.graph.security
+++
+Enables the addition of data to an eDiscovery case without associating it with a custodian. For details, see [Add non-custodial data sources to an eDiscovery (Premium) case](/microsoft-365/compliance/non-custodial-data-sources).
++
+Inherits from [dataSourceContainer](../resources/security-datasourcecontainer.md).
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoveryNoncustodialDataSources](../api/security-ediscoverysearch-list-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|Get a list of the [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) objects and their properties.|
+|[Create ediscoveryNoncustodialDataSource](../api/security-ediscoverysearch-post-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md)|Create a new [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.|
+|[Get ediscoveryNoncustodialDataSource](../api/security-ediscoverynoncustodialdatasource-get.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md)|Read the properties and relationships of an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.|
+|[updateIndex](../api/security-ediscoverynoncustodialdatasource-updateindex.md)|None|Triggers a indexOperation to make a non-custodial data source and associated data sources searchable.|
+|[release](../api/security-ediscoverynoncustodialdatasource-release.md)|None|Release a non-custodial data source from a case.|
+|[applyHold](../api/security-ediscoverynoncustodialdatasource-applyhold.md)|None|Start the process of applying hold to eDiscovery non-custodial data sources.|
+|[removeHold](../api/security-ediscoverynoncustodialdatasource-removehold.md)|None|Start the process of removing hold from eDiscovery non-custodial data sources.|
+|[List ediscoveryIndexOperation](../api/security-ediscoverycustodian-list-lastindexoperation.md)|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) collection|Get a list of the [ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md) associated with an [ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md).|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|createdDateTime|DateTimeOffset|Created date and time of the nonCustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|displayName|String|Display name of the noncustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|id|String|Unique identifier of the nonCustodialDataSource. Inherited from [entity](../resources/entity.md).|
+|lastModifiedDateTime|DateTimeOffset|Last modified date and time of the nonCustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|releasedDateTime|DateTimeOffset|Date and time that the nonCustodialDataSource was released from the case. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md).|
+|status|microsoft.graph.security.dataSourceContainerStatus|Latest status of the nonCustodialDataSource. Inherited from [microsoft.graph.security.datasourcecontainer](../resources/security-datasourcecontainer.md). Possible values are: `Active`, `Released`.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the nonCustodialDataSource.The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|dataSource|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|User source or SharePoint site data source as non-custodial data source.|
+|lastIndexOperation|[microsoft.graph.security.ediscoveryIndexOperation](../resources/security-ediscoveryindexoperation.md)|Operation entity that represents the latest indexing for the non-custodial data source.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryNoncustodialDataSource",
+ "baseType": "microsoft.graph.security.dataSourceContainer",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryNoncustodialDataSource",
+ "id": "String (identifier)",
+ "status": "String",
+ "holdStatus": "String",
+ "lastModifiedDateTime": "String (timestamp)",
+ "releasedDateTime": "String (timestamp)",
+ "displayName": "String",
+ "createdDateTime": "String (timestamp)"
+}
+```
v1.0 Security Ediscoveryreviewset https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryreviewset.md
+
+ Title: "ediscoveryReviewSet resource type"
+description: "Represents the static set of electronically stored information collected for use in a litigation, investigation, or regulatory request."
+
+ms.localizationpriority: medium
++
+# ediscoveryReviewSet resource type
+
+Namespace: microsoft.graph.security
+++
+Represents the static set of electronically stored information collected for use in a litigation, investigation, or regulatory request.
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoveryReviewSets](../api/security-ediscoverycase-list-reviewsets.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) collection|Get a list of the [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) objects and their properties.|
+|[Create ediscoveryReviewSet](../api/security-ediscoverycase-post-reviewsets.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md)|Create a new [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.|
+|[Get ediscoveryReviewSet](../api/security-ediscoveryreviewset-get.md)|[microsoft.graph.security.ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md)|Read the properties and relationships of an [ediscoveryReviewSet](../resources/security-ediscoveryreviewset.md) object.|
+|[addToReviewSet](../api/security-ediscoveryreviewset-addtoreviewset.md)|None|Start the process of adding a collection from Microsoft 365 services to a [review set](../resources/security-ediscoveryreviewset.md).|
+|[List queries](../api/security-ediscoveryreviewset-list-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) collection|Get the list of [queries](../resources/security-ediscoveryreviewsetquery.md) associated with an eDiscovery review set.|
+|[Create ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-post-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Create a new ediscoveryReviewSetQuery object.|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|createdBy|[microsoft.graph.identitySet](../resources/identityset.md)|The user who created the review set. Read-only. |
+|createdDateTime|DateTimeOffset|The datetime when the review set was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.|
+|displayName|String|The review set name. The name is unique with a maximum limit of 64 characters.|
+|id|String|The review set unique identifier. Read-only.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|queries|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) collection|Represents queries within the review set.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewSet",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewSet",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "createdDateTime": "String (timestamp)"
+}
+```
+
v1.0 Security Ediscoveryreviewsetquery https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryreviewsetquery.md
+
+ Title: "ediscoveryReviewSetQuery resource type"
+description: "Represents a review set query, which is used to query and cull data stored in an eDiscovery reviewSet."
+
+ms.localizationpriority: medium
++
+# ediscoveryReviewSetQuery resource type
+
+Namespace: microsoft.graph.security
+++
+Represents a review set query, which is used to query and cull data stored in an eDiscovery [reviewSet](security-ediscoveryreviewset.md).
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoveryReviewSetQueries](../api/security-ediscoveryreviewset-list-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) collection|Get a list of the [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) objects and their properties.|
+|[Create ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-post-queries.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Create a new [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
+|[Get ediscoveryReviewSetQuery](../api/security-ediscoveryreviewsetquery-get.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Read the properties and relationships of an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
+|[Update ediscoveryReviewSetQuery](../api/security-ediscoveryreviewsetquery-update.md)|[microsoft.graph.security.ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md)|Update the properties of an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
+|[Delete ediscoveryReviewSetQuery](../api/security-ediscoveryreviewset-delete-queries.md)|None|Delete an [ediscoveryReviewSetQuery](../resources/security-ediscoveryreviewsetquery.md) object.|
+|[applyTags](../api/security-ediscoveryreviewsetquery-applytags.md)|None|Apply tags to documents that match the specified query.|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+| createdBy | [identitySet](/graph/api/resources/identityset) | The user who created the query. |
+| createdDateTime |DateTimeOffset| The time and date when the query was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
+| displayName | String | The name of the query.|
+| id |String| The unique identifier of the query. Read-only.|
+| lastModifiedBy | [identitySet](/graph/api/resources/identityset) | The user who last modified the query. |
+| lastModifiedDateTime |DateTimeOffset | The date and time the query was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`|
+| query | String | The query string in KQL (Keyword Query Language) query. For details, see [Document metadata fields in eDiscovery (Premium)](/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery). This field maps directly to the keywords condition. You can refine searches by using fields listed in the *searchable field name* paired with values; for example, *subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016*. |
++
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewSetQuery",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewSetQuery",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "description": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "createdDateTime": "String (timestamp)",
+ "lastModifiedBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "lastModifiedDateTime": "String (timestamp)",
+ "contentQuery": "String"
+}
+```
+
v1.0 Security Ediscoveryreviewtag https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoveryreviewtag.md
+
+ Title: "ediscoveryReviewTag resource type"
+description: "Represents an eDiscovery tag, which is used to mark documents during review to separate responsive and non-responsive content"
+
+ms.localizationpriority: medium
++
+# ediscoveryReviewTag resource type
+
+Namespace: microsoft.graph.security
+++
+Represents an eDiscovery tag, which is used to mark documents during review to separate responsive and non-responsive content.
+
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoveryReviewTags](../api/security-ediscoverycase-list-tags.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|Get a list of the [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) objects and their properties.|
+|[Create ediscoveryReviewTag](../api/security-ediscoverycase-post-tags.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Create a new [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
+|[Get ediscoveryReviewTag](../api/security-ediscoveryreviewtag-get.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Read the properties and relationships of an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
+|[Update ediscoveryReviewTag](../api/security-ediscoveryreviewtag-update.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Update the properties of an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
+|[Delete ediscoveryReviewTag](../api/security-ediscoverycase-delete-tags.md)|None|Delete an [ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) object.|
+|[asHierarchy](../api/security-ediscoveryreviewtag-ashierarchy.md)|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|List tags organized as hierarchy.|
++
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|childSelectability|microsoft.graph.security.childSelectability|Indicates whether a single or multiple child tags can be associated with a document. Possible values are: `One`, `Many`. This value controls whether the UX presents the tags as checkboxes or a radio button group.|
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the tag.|
+|description|String|The description for the tag.|
+|displayName|String|Display name of the tag.|
+|id|String|Unique identifier for the tag.|
+|lastModifiedDateTime|DateTimeOffset|The date and time the tag was last modified.|
+
+### childSelectability values
+
+|Member|Description|
+|:-|--|
+|One|Only one child can be selected. This corresponds to a UI that presents the tags with radio buttons.|
+|Many|Zero or many children can be selected. This corresponds to a UI that presents the tags with checkboxes.|
+
+## Relationships
+
+|Relationship|Type|Description|
+|:|:|:|
+|childTags|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md) collection|Returns the tags that are a child of a tag.|
+|parent|[microsoft.graph.security.ediscoveryReviewTag](../resources/security-ediscoveryreviewtag.md)|Returns the parent tag of the specified tag.|
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryReviewTag",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryReviewTag",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "description": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "lastModifiedDateTime": "String (timestamp)",
+ "childSelectability": "String"
+}
+```
+
v1.0 Security Ediscoverysearch https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoverysearch.md
+
+ Title: "ediscoverySearch resource type"
+description: "Represents an eDiscovery search."
+
+ms.localizationpriority: medium
++
+# ediscoverySearch resource type
+
+Namespace: microsoft.graph.security
+++
+Represents an eDiscovery search. For details, see [Collect data for a case in eDiscovery (Premium)](/microsoft-365/compliance/collecting-data-for-ediscovery).
++
+## Methods
+|Method|Return type|Description|
+|:|:|:|
+|[List ediscoverySearches](../api/security-ediscoverycase-list-searches.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) collection|Get a list of the [ediscoverySearch](../resources/security-ediscoverysearch.md) objects and their properties.|
+|[Create ediscoverySearch](../api/security-ediscoverycase-post-searches.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Create a new [ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
+|[Get ediscoverySearch](../api/security-ediscoverysearch-get.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Read the properties and relationships of an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
+|[Update ediscoverySearch](../api/security-ediscoverysearch-update.md)|[microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md)|Update the properties of an [ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
+|[Delete ediscoverySearch](../api/security-ediscoverycase-delete-searches.md)|None|Delete an [microsoft.graph.security.ediscoverySearch](../resources/security-ediscoverysearch.md) object.|
+|[estimateStatistics](../api/security-ediscoverysearch-estimatestatistics.md)|None|Run an estimate statistics operation on the data contained in the eDiscovery search.|
+|[List additionalSources](../api/security-ediscoverysearch-list-additionalsources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Get the list of [additional sources](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Add additionalSources](../api/security-ediscoverysearch-post-additionalsources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Create a new [additional source](../resources/security-datasource.md) associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[List ediscoveryEstimateOperation](../api/security-ediscoverysearch-list-lastestimatestatisticsoperation.md)|[microsoft.graph.security.ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) collection|Get the last [ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md) objects and their properties.|
+|[List custodianSources](../api/security-ediscoverysearch-list-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Get the list of custodial data sources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Add custodianSources](../api/security-ediscoverysearch-post-custodiansources.md)|[microsoft.graph.security.dataSource](../resources/security-datasource.md)|Create a new custodian source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Remove custodianSources](../api/security-ediscoverysearch-delete-custodiansources.md)|None|Remove a [microsoft.graph.security.dataSource](../resources/security-datasource.md) object.|
+|[List noncustodialSources](../api/security-ediscoverysearch-list-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|Get the list of non-custodialSources associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Add noncustodialSources](../api/security-ediscoverysearch-post-noncustodialsources.md)|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md)|Create a new non-custodial source associated with an [eDiscovery search](../resources/security-ediscoverysearch.md).|
+|[Remove noncustodialSources](../api/security-ediscoverysearch-delete-noncustodialsources.md)|None|Remove an [microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) object.|
+
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|contentQuery|String|The query string in KQL (Keyword Query Language) query. For details, see [Keyword queries and search conditions for Content Search and eDiscovery](/microsoft-365/compliance/keyword-queries-and-search-conditions). You can refine searches by using fields paired with values; for example, *subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016*.|
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the **eDiscovery search**.|
+|createdDateTime|DateTimeOffset|The date and time the **eDiscovery search** was created.|
+|dataSourceScopes|microsoft.graph.security.dataSourceScopes|When specified, the collection will span across a service for an entire workload. Possible values are: `none`, `allTenantMailboxes`, `allTenantSites`, `allCaseCustodians`, `allCaseNoncustodialDataSources`.|
+|description|String|The description of the **eDiscovery search**.|
+|displayName|String|The display name of the **eDiscovery search**.|
+|id|String| The ID for the **eDiscovery search**. Read-only. |
+|lastModifiedBy|[identitySet](../resources/identityset.md)|The last user who modified the **eDiscovery search**.|
+|lastModifiedDateTime|DateTimeOffset|The last date and time the **eDiscovery search** was modified.|
+
+### dataSourceScopes values
+
+|Member|Description|
+|:-|--|
+|none|Do not specify any scopes - locations would be referenced separately.|
+|allTenantMailboxes|Include all tenant mailboxes in the **eDiscovery search**.|
+|allTenantSites|Include all tenant sites in the **eDiscovery search**.|
+|allCaseCustodians|Include all custodian locations in the **eDiscovery search**.|
+|allCaseNoncustodialDataSources|Include all non-custodial data sources in the **eDiscovery search**.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|additionalSources|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|Adds an additional source to the **eDiscovery search**.|
+|addToReviewSetOperation|[microsoft.graph.security.ediscoveryAddToReviewSetOperation](../resources/security-ediscoveryaddtoreviewsetoperation.md)|Adds the results of the **eDiscovery search** to the specified **reviewSet**.|
+|custodianSources|[microsoft.graph.security.dataSource](../resources/security-datasource.md) collection|**Custodian** sources that are included in the **eDiscovery search**.|
+|lastEstimateStatisticsOperation|[microsoft.graph.security.ediscoveryEstimateOperation](../resources/security-ediscoveryestimateoperation.md)|The last estimate operation associated with the **eDiscovery search**.|
+|noncustodialSources|[microsoft.graph.security.ediscoveryNoncustodialDataSource](../resources/security-ediscoverynoncustodialdatasource.md) collection|**noncustodialDataSource** sources that are included in the **eDiscovery search**|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoverySearch",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoverySearch",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "description": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "createdDateTime": "String (timestamp)",
+ "lastModifiedBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "lastModifiedDateTime": "String (timestamp)",
+ "contentQuery": "String",
+ "dataSourceScopes": "String"
+}
+```
v1.0 Security Ediscoverytagoperation https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ediscoverytagoperation.md
+
+ Title: "ediscoveryTagOperation resource type"
+description: "Represents the process of tagging files in eDiscovery review set."
+
+ms.localizationpriority: medium
++
+# ediscoveryTagOperation resource type
+
+Namespace: microsoft.graph.security
+
+Represents the process of tagging files in eDiscovery review set.
++
+Inherits from [caseOperation](../resources/security-caseoperation.md).
+
+## Methods
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|action|[microsoft.graph.security.caseAction](../resources/security-caseoperation.md#caseaction-values)| The type of action the operation represents. Possible values are: `addToReviewSet`,`applyTags`,`contentExport`,`convertToPdf`,`estimateStatistics`, `purgeData`.|
+|completedDateTime|DateTimeOffset| The date and time the operation was completed. |
+|createdBy|[identitySet](../resources/identityset.md)| The user that created the operation. |
+|createdDateTime|DateTimeOffset| The date and time the operation was created. |
+|id|String| The ID for the operation. Read-only. |
+|percentProgress|Int32| The progress of the operation. |
+|resultInfo|[resultInfo](../resources/resultinfo.md)| Contains success and failure-specific result information. |
+|status|[microsoft.graph.security.caseOperationStatus](../resources/security-caseoperation.md#caseoperationstatus-values)| The status of the case operation. Possible values are: `notStarted`, `submissionFailed`, `running`, `succeeded`, `partiallySucceeded`, `failed`.|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.ediscoveryTagOperation",
+ "baseType": "microsoft.graph.security.caseOperation",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ediscoveryTagOperation",
+ "id": "String (identifier)",
+ "createdDateTime": "String (timestamp)",
+ "completedDateTime": "String (timestamp)",
+ "action": "String",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "percentProgress": "Integer",
+ "status": "String",
+ "resultInfo": {
+ "@odata.type": "microsoft.graph.resultInfo"
+ }
+}
+```
+
v1.0 Security Ocrsettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-ocrsettings.md
+
+ Title: "ocrSettings resource type"
+description: "Represents the OCR settings for an eDiscovery case."
+
+ms.localizationpriority: medium
++
+# ocrSettings resource type
+
+Namespace: microsoft.graph.security
+++
+Represents the Optical Character Recognition (OCR) settings for an eDiscovery case.
++
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|isEnabled|Boolean|Indicates whether or not OCR is enabled for the case.|
+|maxImageSize|Int32|Maximum image size that will be processed in KB).|
+|timeout|Duration|The timeout duration for the OCR engine. A longer timeout might increase success of OCR, but might add to the total processing time.|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "@odata.type": "microsoft.graph.security.ocrSettings"
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.ocrSettings",
+ "isEnabled": "Boolean",
+ "maxImageSize": "Integer",
+ "timeout": "String (duration)"
+}
+```
+
v1.0 Security Redundancydetectionsettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-redundancydetectionsettings.md
+
+ Title: "redundancyDetectionSettings resource type"
+description: "Represents redundancy settings for an eDiscovery case."
+
+ms.localizationpriority: medium
++
+# redundancyDetectionSettings resource type
+
+Namespace: microsoft.graph.security
+++
+Represents redundancy (email threading and near duplicate detection) settings for an eDiscovery case.
++
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|isEnabled|Boolean|Indicates whether email threading and near duplicate detection are enabled.|
+|maxWords|Int32|Specifies the maximum number of words used for email threading and near duplicate detection. To learn more, see [Minimum/maximum number of words](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#near-duplicates-and-email-threading).|
+|minWords|Int32|Specifies the minimum number of words used for email threading and near duplicate detection. To learn more, see [Minimum/maximum number of words](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#near-duplicates-and-email-threading).|
+|similarityThreshold|Int32|Specifies the similarity level for documents to be put in the same near duplicate set. To learn more, see [Document and email similarity threshold](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#near-duplicates-and-email-threading).|
++
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "@odata.type": "microsoft.graph.security.redundancyDetectionSettings"
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.redundancyDetectionSettings",
+ "isEnabled": "Boolean",
+ "similarityThreshold": "Integer",
+ "minWords": "Integer",
+ "maxWords": "Integer"
+}
+```
+
v1.0 Security Sitesource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-sitesource.md
+
+ Title: "siteSource resource type"
+description: "The container for a site associated with a custodian."
+
+ms.localizationpriority: medium
++
+# siteSource resource type
+
+Namespace: microsoft.graph.security
++
+The container for a site associated with a custodian.
+
+Inherits from [dataSource](../resources/security-datasource.md).
++
+## Methods
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the **siteSource**.|
+|createdDateTime|DateTimeOffset|The date and time the **siteSource** was created.|
+|displayName|String|The display name of the **siteSource**. This will be the name of the SharePoint site.|
+|id|String| The ID of the **siteSource**. |
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **siteSource**. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|site|[site](../resources/site.md)|The SharePoint site associated with the **siteSource**.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.siteSource",
+ "baseType": "microsoft.graph.security.dataSource",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.siteSource",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "holdStatus": "String",
+ "createdDateTime": "String (timestamp)",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ }
+}
+```
+
v1.0 Security Topicmodelingsettings https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-topicmodelingsettings.md
+
+ Title: "topicModelingSettings resource type"
+description: "Represents topic modeling settings for an eDiscovery case"
+
+ms.localizationpriority: medium
++
+# topicModelingSettings resource type
+
+Namespace: microsoft.graph.security
+++
+Represents topic modeling (Themes) settings for an eDiscovery case. To learn more, see [Configure search and analytics settings in eDiscovery (Premium)](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery).
++
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|dynamicallyAdjustTopicCount|Boolean|Indicates whether the themes model should dynamically optimize the number of generated topics. To learn more, see [Adjust maximum number of themes dynamically](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
+|ignoreNumbers|Boolean|Indicates whether the themes model should exclude numbers while parsing document texts. To learn more, see [Include numbers in themes](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
+|isEnabled|Boolean|Indicates whether themes model is enabled for the case.|
+|topicCount|Int32|The total number of topics that the themes model will generate for a review set. To learn more, see [Maximum number of themes](/microsoft-365/compliance/configure-search-and-analytics-settings-in-advanced-ediscovery#themes).|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "@odata.type": "microsoft.graph.security.topicModelingSettings"
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.topicModelingSettings",
+ "isEnabled": "Boolean",
+ "ignoreNumbers": "Boolean",
+ "topicCount": "Integer",
+ "dynamicallyAdjustTopicCount": "Boolean"
+}
+```
+
v1.0 Security Unifiedgroupsource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-unifiedgroupsource.md
+
+ Title: "unifiedGroupSource resource type"
+description: "The container for a custodian's group."
+
+ms.localizationpriority: medium
++
+# unifiedGroupSource resource type
+
+Namespace: microsoft.graph.security
+++
+The container for a custodian's group.
+
+Inherits from [dataSource](../resources/security-datasource.md).
+
+## Methods
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the **unifiedGroupSource**.|
+|createdDateTime|DateTimeOffset|The date and time the **unifiedGroupSource** was created.|
+|displayName|String|The display name of the unified group, which is the name of the group.|
+|id|String|The ID of the **unifiedGroupSource**. This is not the ID of the actual group.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **unifiedGroupSource**. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`|
+
+### sourceType values
+|Member|Description|
+|:-|--|
+| mailbox | Represents a mailbox.|
+| site | Represents a SharePoint site.|
+
+## Relationships
+|Relationship|Type|Description|
+|:|:|:|
+|group|[group](../resources/group.md)|Represents a group.|
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.unifiedGroupSource",
+ "baseType": "microsoft.graph.security.dataSource",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.unifiedGroupSource",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "holdStatus": "String",
+ "createdDateTime": "String (timestamp)",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "includedSources": "String"
+}
+```
+
v1.0 Security Usersource https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/resources/security-usersource.md
+
+ Title: "userSource resource type"
+description: "The container for a user's mailbox and OneDrive for Business site."
+
+ms.localizationpriority: medium
++
+# userSource resource type
+
+Namespace: microsoft.graph.security
+++
+The container for a user's mailbox and OneDrive for Business site.
+
+Inherits from [dataSource](../resources/security-datasource.md).
+
+## Methods
+None.
+## Properties
+|Property|Type|Description|
+|:|:|:|
+|createdBy|[identitySet](../resources/identityset.md)|The user who created the **userSource**.|
+|createdDateTime|DateTimeOffset|The date and time the **userSource** was created.|
+|displayName|String|The display name associated with the mailbox and site.|
+|email|String|Email address of the user's mailbox.|
+|id|String|The ID of the **userSource**. This is not the ID of the actual group.|
+|includedSources|microsoft.graph.security.sourceType|Specifies which sources are included in this group. Possible values are: `mailbox`, `site`.|
+|siteWebUrl|String|The URL of the user's OneDrive for Business site. Read-only.|
+|holdStatus|microsoft.graph.security.dataSourceHoldStatus|The hold status of the **userSource**. The possible values are: `notApplied`, `applied`, `applying`, `removing`, `partial`.|
+
+### userSourceHoldStatus values
+
+|Name|Description|
+|:-|--|
+|notApplied|The userSource is not on hold (all sources in it are not on hold).|
+|applied|The userSource is on hold (all sources are on hold).|
+|applying|The userSource is in applying hold state (applyHold operation triggered).|
+|removing|The userSource is in removing the hold state (removeHold operation triggered).|
+|partial|The userSource is in mixed state where some sources are on hold and some not on hold or error state.|
+
+## Relationships
+None.
+
+## JSON representation
+The following is a JSON representation of the resource.
+<!-- {
+ "blockType": "resource",
+ "keyProperty": "id",
+ "@odata.type": "microsoft.graph.security.userSource",
+ "baseType": "microsoft.graph.security.dataSource",
+ "openType": false
+}
+-->
+``` json
+{
+ "@odata.type": "#microsoft.graph.security.userSource",
+ "id": "String (identifier)",
+ "displayName": "String",
+ "holdStatus": "String",
+ "createdDateTime": "String (timestamp)",
+ "createdBy": {
+ "@odata.type": "microsoft.graph.identitySet"
+ },
+ "email": "String",
+ "includedSources": "String",
+ "siteWebUrl": "String"
+}
+```
v1.0 Toc.Yml https://github.com/microsoftgraph/microsoft-graph-docs/commits/main/api-reference/v1.0/toc.yml a/api-reference/v1.0/toc.yml
items:
href: api/alert-get.md - name: Update alert href: api/alert-update.md
+ - name: eDiscovery
+ items:
+ - name: Case
+ href: resources/security-ediscoverycase.md
+ items:
+ - name: List
+ href: api/security-casesroot-list-ediscoverycases.md
+ - name: Create
+ href: api/security-casesroot-post-ediscoverycases.md
+ - name: Get
+ href: api/security-ediscoverycase-get.md
+ - name: Update
+ href: api/security-ediscoverycase-update.md
+ - name: Delete
+ href: api/security-casesroot-delete-ediscoverycases.md
+ - name: Close
+ href: api/security-ediscoverycase-close.md
+ - name: Reopen
+ href: api/security-ediscoverycase-reopen.md
+ - name: List operations
+ href: api/security-ediscoverycase-list-operations.md
+ - name: List custodians
+ href: api/security-ediscoverycase-list-custodians.md
+ - name: Create custodian
+ href: api/security-ediscoverycase-post-custodians.md
+ - name: List non-custodial data sources
+ href: api/security-ediscoverycase-list-noncustodialdatasources.md
+ - name: Create non-custodial data source
+ href: api/security-ediscoverycase-post-noncustodialdatasources.md
+ - name: List searches
+ href: api/security-ediscoverycase-list-searches.md
+ - name: Create search
+ href: api/security-ediscoverycase-post-searches.md
+ - name: List review sets
+ href: api/security-ediscoverycase-list-reviewsets.md
+ - name: Create review set
+ href: api/security-ediscoverycase-post-reviewsets.md
+ - name: List tags
+ href: api/security-ediscoverycase-list-tags.md
+ - name: Create tag
+ href: api/security-ediscoverycase-post-tags.md
+ - name: Case settings
+ href: resources/security-ediscoverycasesettings.md
+ items:
+ - name: Get settings
+ href: api/security-ediscoverycasesettings-get.md
+ - name: Update settings
+ href: api/security-ediscoverycasesettings-update.md
+ - name: Reset settings to default
+ href: api/security-ediscoverycasesettings-resettodefault.md
+ - name: Operation
+ href : resources/security-caseoperation.md
+ items:
+ - name: List case operations
+ href: api/security-ediscoverycase-list-operations.md
+ - name: Get case opreation by id
+ href: api/security-caseoperation-get.md
+ - name: Custodian
+ href: resources/security-ediscoverycustodian.md
+ items:
+ - name: List
+ href: api/security-ediscoverycase-list-custodians.md
+ - name: Create
+ href: api/security-ediscoverycase-post-custodians.md
+ - name: Get
+ href: api/security-ediscoverycustodian-get.md
+ - name: Activate
+ href: api/security-ediscoverycustodian-activate.md
+ - name: Release
+ href: api/security-ediscoverycustodian-release.md
+ - name: Apply hold
+ href: api/security-ediscoverycustodian-applyhold.md
+ - name: Remove hold
+ href: api/security-ediscoverycustodian-removehold.md
+ - name: Update index
+ href: api/security-ediscoverycustodian-updateindex.md
+ - name: List user sources
+ href: api/security-ediscoverycustodian-list-usersources.md
+ - name: Create user source
+ href: api/security-ediscoverycustodian-post-usersources.md
+ - name: List site sources
+ href: api/security-ediscoverycustodian-list-sitesources.md
+ - name: Create site source
+ href: api/security-ediscoverycustodian-post-sitesources.md
+ - name: List unitifed group sources
+ href: api/security-ediscoverycustodian-list-unifiedgroupsources.md
+ - name: Create unifed group source
+ href: api/security-ediscoverycustodian-post-unifiedgroupsources.md
+ - name: Get last index operation
+ href: api/security-ediscoverycustodian-list-lastindexoperation.md
+ - name: Non-custodial data source
+ href: resources/security-ediscoverynoncustodialdatasource.md
+ items:
+ - name: List
+ href: api/security-ediscoverycase-list-noncustodialdatasources.md
+ - name: Create
+ href: api/security-ediscoverycase-post-noncustodialdatasources.md
+ - name: Get
+ href: api/security-ediscoverynoncustodialdatasource-get.md
+ - name: Release
+ href: api/security-ediscoverynoncustodialdatasource-release.md
+ - name: Apply hold
+ href: api/security-ediscoverynoncustodialdatasource-applyhold.md
+ - name: Remove hold
+ href: api/security-ediscoverynoncustodialdatasource-removehold.md
+ - name: Update index
+ href: api/security-ediscoverynoncustodialdatasource-updateindex.md
+ - name: Get last index operation
+ href: api/security-ediscoverycustodian-list-lastindexoperation.md
+ - name: Search
+ href: resources/security-ediscoverysearch.md
+ items:
+ - name: List
+ href: api/security-ediscoverycase-list-searches.md
+ - name: Create
+ href: api/security-ediscoverycase-post-searches.md
+ - name: Get
+ href: api/security-ediscoverysearch-get.md
+ - name: Update
+ href: api/security-ediscoverysearch-update.md
+ - name: Delete
+ href: api/security-ediscoverycase-delete-searches.md
+ - name: Estimate statistics
+ href: api/security-ediscoverysearch-estimatestatistics.md
+ - name: List custodian sources
+ href: api/security-ediscoverysearch-list-custodiansources.md
+ - name: Add custodian sources
+ href: api/security-ediscoverysearch-post-custodiansources.md
+ - name: Remove custodian sources
+ href: api/security-ediscoverysearch-delete-custodiansources.md
+ - name: List non-custodial data sources
+ href: api/security-ediscoverysearch-list-noncustodialsources.md
+ - name: Add non-custodial data sources
+ href: api/security-ediscoverysearch-post-noncustodialsources.md
+ - name: Remove non-custodial data sources
+ href: api/security-ediscoverysearch-delete-noncustodialsources.md
+ - name: List additional sources
+ href: api/security-ediscoverysearch-list-additionalsources.md
+ - name: Add additional sources
+ href: api/security-ediscoverysearch-post-additionalsources.md
+ - name: Get last estimate statistics operation
+ href: api/security-ediscoverysearch-list-lastestimatestatisticsoperation.md
+ - name: Review set
+ href: resources/security-ediscoveryreviewset.md
+ items:
+ - name: List
+ href: api/security-ediscoverycase-list-reviewsets.md
+ - name: Create
+ href: api/security-ediscoverycase-post-reviewsets.md
+ - name: Get
+ href: api/security-ediscoveryreviewset-get.md
+ - name: Add to review set
+ href: api/security-ediscoveryreviewset-addtoreviewset.md
+ - name: Query
+ href: resources/security-ediscoveryreviewsetquery.md
+ items:
+ - name: List
+ href: api/security-ediscoveryreviewset-list-queries.md
+ - name: Create
+ href: api/security-ediscoveryreviewset-post-queries.md
+ - name: Get
+ href: api/security-ediscoveryreviewsetquery-get.md
+ - name: Update
+ href: api/security-ediscoveryreviewsetquery-update.md
+ - name: Delete
+ href: api/security-ediscoveryreviewset-delete-queries.md
+ - name: Apply tags
+ href: api/security-ediscoveryreviewsetquery-applytags.md
+ - name: Tag
+ href: resources/security-ediscoveryreviewtag.md
+ items:
+ - name: List
+ href: api/security-ediscoverycase-list-tags.md
+ - name: Create
+ href: api/security-ediscoverycase-post-tags.md
+ - name: Get
+ href: api/security-ediscoveryreviewtag-get.md
+ - name: Update
+ href: api/security-ediscoveryreviewtag-update.md
+ - name: Delete
+ href: api/security-ediscoverycase-delete-tags.md
+ - name: List tags as hierarchy
+ href: api/security-ediscoveryreviewtag-ashierarchy.md
- name: Information protection items: - name: Threat assessment