- Least privileged Microsoft Graph permission to access the action via application:
eDiscovery.Read.All. - Higher privileged Microsoft Graph permission to access the action via application:
eDiscovery.ReadWrite.All.
External DocumentationTo learn more, visit the Microsoft E-Discovery documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Content Query | The query used for the search in Keyword Query Language. |
| Custodian Data Source | A single or a comma-separated list of Custodian Sources. Custodians are typically URLs pointing to specific users, sites, or groups within an eDiscovery case.Note: At least one Custodian or Noncustodial data source is required to execute this action.Valid Formats: * https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/custodians/{CustodianID}/userSources/{UserSourceID}* https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/custodians/{CustodianID}/siteSources/{SiteSourceID}You can obtain each of the required IDs by using the following actions: List E-Discovery Cases, List Custodians, List Custodians User Sources. |
| Description | The description of the search. |
| Display Name | The display name of the search. |
| E-Discovery Case ID | The e-Discovery case ID of the case that the search will belong to. Can be obtained by using the List Cases action. |
| Noncustodial Data Source | A single or a comma-separated list of Noncustodial Sources to include in the search. Noncustodial sources reference data sources that are not tied to a specific custodian, such as shared mailboxes or public folders.Note: At least one Custodian or Noncustodial data source is required to execute this action.Valid Formats: * https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/noncustodialdatasources/{NoncustodialSourceID}You Can obtain each of the required IDs by using the following actions: List E-Discovery Cases, Create Noncustodial Data Source. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Date Source Scopes | The option to search across all mailboxes or sites in the tenant. |
Example Output
{
"displayName": "My search 2",
"description": "My first search",
"contentQuery": "(Author=\"edison\")",
"custodianSources@odata.bind": [
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')"
],
"noncustodialSources@odata.bind": [
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043"
]
}