> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create E-Discovery Search

Creates an e-Discovery search.

* **Least privileged** Microsoft Graph permission to access the action via **application**: `eDiscovery.Read.All`.
* **Higher privileged** Microsoft Graph permission to access the action via **application**: `eDiscovery.ReadWrite.All`.

<Note>
  External Documentation

  To learn more, visit the [Microsoft E-Discovery documentation](https://learn.microsoft.com/en-us/graph/api/security-ediscoverycase-post-searches?view=graph-rest-1.0\&tabs=http).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter                | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
  | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Content Query            | The query used for the search in Keyword Query Language.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
  | Custodian Data Source    | A single or a comma-separated list of `Custodian Sources`. Custodians are typically URLs pointing to specific users, sites, or groups within an eDiscovery case.<br /><br />**Note**: At least one `Custodian` or `Noncustodial` data source is required to execute this action.<br /><br />**Valid Formats**: <br /><br />\* `https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/custodians/{CustodianID}/userSources/{UserSourceID}`<br /><br />\* `https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/custodians/{CustodianID}/siteSources/{SiteSourceID}`<br /><br />You can obtain each of the required IDs by using the following actions: `List E-Discovery Cases`, `List Custodians`, `List Custodians User Sources`. |
  | Description              | The description of the search.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
  | Display Name             | The display name of the search.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
  | E-Discovery Case ID      | The e-Discovery case ID of the case that the search will belong to. Can be obtained by using the `List Cases` action.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
  | Noncustodial Data Source | A single or a comma-separated list of `Noncustodial Sources` to include in the search. Noncustodial sources reference data sources that are not tied to a specific custodian, such as shared mailboxes or public folders.<br /><br />**Note**: At least one `Custodian` or `Noncustodial` data source is required to execute this action.<br /><br />**Valid Formats**: <br /><br />\* `https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/{CaseID}/noncustodialdatasources/{NoncustodialSourceID}`<br /><br />You Can obtain each of the required IDs by using the following actions: `List E-Discovery Cases`, `Create Noncustodial Data Source`.                                                                                                          |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter          | Description                                                       |
  | ------------------ | ----------------------------------------------------------------- |
  | Date Source Scopes | The option to search across all mailboxes or sites in the tenant. |
</div>

## Example Output

```json theme={"dark"}
{
	"displayName": "My search 2",
	"description": "My first search",
	"contentQuery": "(Author=\"edison\")",
	"custodianSources@odata.bind": [
		"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
		"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
		"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')"
	],
	"noncustodialSources@odata.bind": [
		"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043"
	]
}
```

## Workflow Library Example

[Create E Discovery Search with Microsoft E Discovery and Send Results Via Email](https://library.blinkops.com/workflows/create-e-discovery-search-with-microsoft-e-discovery-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/create-e-discovery-search-with-microsoft-e-discovery-and-send-results-via-email/canvas" />
</div>