Actions
Create E-Discovery Search
Creates an e-Discovery search.
- Least privileged Microsoft Graph permission to access the action via application:
eDiscovery.Read.All
. - Higher privileged Microsoft Graph permission to access the action via application:
eDiscovery.ReadWrite.All
.
External Documentation
To learn more, visit the Microsoft E-Discovery documentation.
Basic Parameters
Parameter | Description |
---|---|
Content Query | The query used for the search in Keyword Query Language. |
Custodian Data Source | A single or a comma-separated list of Custodian Sources . Custodians are typically URLs pointing to specific users, sites, or groups within an eDiscovery case.Note: At least one Custodian or Noncustodial data source is required to execute this action.Valid Formats: * https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/custodians/{CustodianID}/userSources/{UserSourceID} * https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/custodians/{CustodianID}/siteSources/{SiteSourceID} You can obtain each of the required IDs by using the following actions: List E-Discovery Cases , List Custodians , List Custodians User Sources . |
Description | The description of the search. |
Display Name | The display name of the search. |
E-Discovery Case ID | The e-Discovery case ID of the case that the search will belong to. Can be obtained by using the List Cases action. |
Noncustodial Data Source | A single or a comma-separated list of Noncustodial Sources to include in the search. Noncustodial sources reference data sources that are not tied to a specific custodian, such as shared mailboxes or public folders.Note: At least one Custodian or Noncustodial data source is required to execute this action.Valid Formats: * https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/noncustodialdatasources/{NoncustodialSourceID} You Can obtain each of the required IDs by using the following actions: List E-Discovery Cases , Create Noncustodial Data Source . |
Advanced Parameters
Parameter | Description |
---|---|
Date Source Scopes | The option to search across all mailboxes or sites in the tenant. |
Example Output
Workflow Library Example
Create E Discovery Search with Microsoft E Discovery and Send Results Via Email
Preview this Workflow on desktop
Was this page helpful?