Permission issue when adding ediscovery case member

Question

Using API to add role group to purview case but results in permission error

POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/caseMembers

It has been working fine few days back. Are there any recents changes made related to permissions? What all permissions should be added to make the API user be able to add role groups?

Answer 1

For adding members (including role groups) to an eDiscovery case via:

POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/caseMembers

the following permissions and roles are required.

1. Microsoft Graph permissions (API permissions)

For this API, the least-privileged permissions are:

• Delegated (work or school account):
  • eDiscovery.Read.All (least privileged)
  • or eDiscovery.ReadWrite.All (higher privileged)
• Application:
  • eDiscovery.Read.All (least privileged)
  • or eDiscovery.ReadWrite.All (higher privileged)

To add case members (write operation), eDiscovery.ReadWrite.All is required (delegated or application, depending on how the app is used).

2. Purview / eDiscovery RBAC roles for the signed-in user (delegated scenario)

For delegated access with a work or school account, the user behind the token must also be assigned a supported Microsoft Purview role via role groups:

• eDiscovery Manager
  • Can create and manage only the cases they create, including custodians, holds, searches, and other case management tasks.
  • This is the least-privileged option for managing their own cases.
• eDiscovery Administrator
  • Has all eDiscovery Manager permissions, plus:
    • Access and manage all eDiscovery cases in the organization.
    • Configure eDiscovery settings.
    • Manage any case after adding themselves as a member.

Additional role groups that provide write access to eDiscovery features (and can affect case membership and related actions):

• Compliance Administrator
  • Includes Case Management, Compliance Search, and Hold permissions.
• Organization Management
  • Includes Case Management, Compliance Search, Hold, and Search And Purge permissions.

3. Case-level access and role groups

• Before a user can access and perform tasks in a case, the user must be in an appropriate role group (for example, eDiscovery Manager or eDiscovery Administrator) in the Microsoft Purview portal.
• Role groups can be added as members of eDiscovery cases. The roles assigned to the role group determine what its members can do in that case.
• If roles are added to or removed from a role group that is already a member of a case, that role group is automatically removed from all cases it belongs to. Deleting a role group also removes it from all cases. If this was changed recently, it can cause new permission errors until the role group is re-added to the case.

4. What to check for the recent failure

Given that the API worked a few days ago and now fails with a permission error, verify the following:

1. Graph API permissions on the app registration:
   • Confirm eDiscovery.ReadWrite.All is still granted (delegated or application as appropriate) and that admin consent has not been revoked.
2. Purview role group membership of the calling user (delegated):
   • Ensure the user is still a member of one of:
     • eDiscovery Manager
     • eDiscovery Administrator
     • or another role group that includes Case Management and related eDiscovery write permissions (Compliance Administrator, Organization Management).
3. Role group changes:
   • Check whether roles were added/removed from the role group that is being added to the case. If so, that role group may have been automatically removed from existing cases; re-add it to the case if needed.
4. Case access:
   • Ensure the calling identity still has access to the specific case (for eDiscovery Manager, it must be a case they created; for eDiscovery Administrator, they can access all cases after adding themselves as a member).

If any of the above permissions or role assignments were changed or removed recently, restoring them (especially eDiscovery.ReadWrite.All and appropriate Purview eDiscovery role group membership) should resolve the permission error when calling POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/caseMembers.

---

References:

• Add ediscoveryCaseMember
• List ediscoveryCaseMember objects
• List ediscoveryCases
• Add additional sources
• Assign permissions in eDiscovery
• Learn about access and permission settings in eDiscovery cases
• Permissions in the Microsoft Purview portal