> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft E Discovery

## Overview

This guide walks through how to create a Microsoft eDiscovery connection and the permissions it requires to be used in Blink's Automated Case Management, across **Ingestion**, **Enrichment**, and **Response** workflows.

<Note>
  Permission requirements can vary by workflow type. See [Required Permissions](#required-permissions) for the full breakdown by connection option.
</Note>

***

## Creating a Connection

You can authenticate to Microsoft eDiscovery in one of two ways. Both are supported across every Microsoft integration in Blink's Automated Case Management, so the connection you choose here can be reused elsewhere.

<Tabs>
  <Tab title="Microsoft Graph">
    Recommended if this connection will be reused across other Microsoft integrations in your Automated Case Management setup.

    ### Creating a Connection

    <Card title="Microsoft Graph Connection Guide" icon="arrow-up-right-from-square" href="https://docs.blinkops.com/docs/integrations/microsoft-graph">
      Follow this guide to create a Microsoft Graph connection
    </Card>

    ### Required Permissions

    <Accordion title="Required Permissions for Microsoft Graph">
      | Permissions |
      | - |
      | AuditLog.Read.All |
      | Calendars.ReadBasic |
      | Calendars.ReadWrite |
      | Calendars.ReadWrite.Shared |
      | Channel.Create |
      | ChannelMember.ReadWrite.All |
      | ChannelMessage.ReadWrite |
      | ChannelMessage.Send |
      | ChannelSettings.ReadWrite.All |
      | Chat.Create |
      | Chat.ReadWrite |
      | Chat.ReadWrite.All |
      | ChatMember.ReadWrite |
      | Device.Command |
      | Device.Read.All |
      | DeviceManagementApps.ReadWrite.All |
      | DeviceManagementManagedDevices.PrivilegedOperations.All |
      | DeviceManagementManagedDevices.ReadWrite.All |
      | Directory.AccessAsUser.All |
      | Directory.ReadWrite.All |
      | eDiscovery.ReadWrite.All |
      | Files.ReadWrite |
      | Files.ReadWrite.All |
      | Group.ReadWrite.All |
      | GroupMember.ReadWrite.All |
      | IdentityRiskyUser.Read.All |
      | IdentityRiskyUser.ReadWrite.All |
      | Mail.Read |
      | Mail.ReadBasic |
      | Mail.ReadWrite |
      | Mail.ReadWrite.Shared |
      | Mail.Send |
      | MailboxSettings.ReadWrite |
      | Notes.ReadWrite.All |
      | offline\_access |
      | OnlineMeetings.ReadWrite |
      | SecurityAlert.Read.All |
      | SecurityAlert.ReadWrite.All |
      | SecurityIncident.ReadWrite.All |
      | Sites.Manage.All |
      | Sites.ReadWrite.All |
      | TeamMember.ReadWrite.All |
      | ThreatHunting.Read.All |
      | User.EnableDisableAccount.All |
      | User.ManageIdentities.All |
      | User.Read |
      | User.ReadWrite.All |
      | User.RevokeSessions.All |
      | DeviceLocalCredential.ReadBasic.All |
      | SecurityCopilotWorkspaces.ReadWrite.All |
    </Accordion>
  </Tab>

  <Tab title="Microsoft eDiscovery">
    Recommended if this connection will be used for eDiscovery only.

    ### Creating a Connection

    <Card title="Microsoft eDiscovery Connection Guide" icon="arrow-up-right-from-square" href="https://docs.blinkops.com/docs/integrations/microsoft-e-discovery">
      Follow this guide to create a Microsoft eDiscovery connection
    </Card>

    ### Required Permissions

    | Permission |
    | - |
    | `eDiscovery.Read.All` |
    | `eDiscovery.ReadWrite.All` |
    | `eDiscovery.Download.Read` |

    <Info>
      In addition to the scopes above, the connection requires the **eDiscovery Manager** or **eDiscovery Administrator** role in Microsoft Purview. Searching email across mailboxes also depends on the relevant noncustodial/custodial data source being configured.
    </Info>
  </Tab>
</Tabs>

<AccordionGroup>
  <Accordion title="Which stage of Alert Processing need this connection?" icon="table">
    | Source | Requires this connection? | Notes |
    | - | - | - |
    | Ingestion | ✗ No | Not applicable |
    | Enrichment | ✗ No | Not applicable |
    | Response | ✓ Yes | Searches and manages email across mailboxes for investigation/response |
  </Accordion>
</AccordionGroup>

***


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.