ediscoveryCustodian resource type

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

In the context of eDiscovery, represents a user and all of their digital assets, such as email and documents.

Methods

Method	Return type	Description
List	microsoft.graph.security.ediscoveryCustodian collection	Get a list of the ediscoveryCustodian objects and their properties.
Create	microsoft.graph.security.ediscoveryCustodian	Create a new ediscoveryCustodian object.
Get	microsoft.graph.security.ediscoveryCustodian	Read the properties and relationships of an ediscoveryCustodian object.
Update index	Triggers a indexOperation to make a custodian and associated sources searchable.
Activate	None	Re-activate a custodian from a case.
Release	None	Release a custodian from a case.
Apply hold	None	Start the process of applying hold to eDiscovery custodians.
Remove hold	None	Start the process of removing hold from eDiscovery custodians.
Get last index operation	microsoft.graph.security.ediscoveryIndexOperation collection	Get a list of the ediscoveryIndexOperation associated with an ediscoveryCustodian.
Site sources
List	microsoft.graph.security.siteSource collection	Get a list of the siteSource objects associated with an ediscoveryCustodian.
Create	microsoft.graph.security.siteSource	Create a new siteSource object associated with an ediscoveryCustodian.
Delete	None	Delete a siteSource object associated with an ediscoveryCustodian.
Unified group sources
List	microsoft.graph.security.unifiedGroupSource collection	Get a list of the unifiedGroupSource objects associated with an ediscoveryCustodian.
Create	microsoft.graph.security.unifiedGroupSource	Create a new unifiedGroupSource object associated with an ediscoveryCustodian.
Delete	None	Delete a unifiedGroupSource object associated with an ediscoveryCustodian.
User sources
List	microsoft.graph.security.userSource collection	Get a list of the userSource objects associated with an ediscoveryCustodian or ediscoveryHoldPolicy.
Create	microsoft.graph.security.userSource	Create a new userSource object associated with an ediscoveryCustodian.
Delete	None	Delete a userSource object associated with an ediscoveryCustodian.

Properties

Property	Type	Description
acknowledgedDateTime	DateTimeOffset	Date and time the custodian acknowledged a hold notification.
createdDateTime	DateTimeOffset	Date and time when the custodian was added to the case.
displayName	String	Display name of the custodian.
email	String	Email address of the custodian.
id	String	The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime	DateTimeOffset	Date and time the custodian object was last modified
releasedDateTime	DateTimeOffset	Date and time the custodian was released from the case.
status	microsoft.graph.security.dataSourceContainerStatus	Status of the custodian. Possible values are: active, released.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial

custodianStatus values

Name	Description
active	Custodian is an active part of the case.
released	Custodian is released from the case.

custodianHoldStatus values

Name	Description
notApplied	The custodian is not on Hold (all sources in it are not on hold).
applied	The custodian is on Hold (all sources are on hold).
applying	The custodian is in applying hold state (applyHold operation triggered).
removing	The custodian is in removing the hold state(removeHold operation triggered).
partial	The custodian is in mixed state where some sources are on hold and some not on hold or error state.

Relationships

Relationship	Type	Description
lastIndexOperation	microsoft.graph.security.ediscoveryIndexOperation	Operation entity that represents the latest indexing for the custodian.
siteSources	microsoft.graph.security.siteSource collection	Data source entity for SharePoint sites associated with the custodian.
unifiedGroupSources	microsoft.graph.security.unifiedGroupSource collection	Data source entity for groups associated with the custodian.
userSources	microsoft.graph.security.userSource collection	Data source entity for a custodian. This is the container for a custodian's mailbox and OneDrive for Business site.

JSON representation

The following JSON representation shows the resource type.

JSON

{
  "@odata.type": "#microsoft.graph.security.ediscoveryCustodian",
  "id": "String (identifier)",
  "status": "String",
  "holdStatus": "String",
  "lastModifiedDateTime": "String (timestamp)",
  "releasedDateTime": "String (timestamp)",
  "displayName": "String",
  "createdDateTime": "String (timestamp)",
  "email": "String",
  "acknowledgedDateTime": "String (timestamp)"
}