ediscoveryHoldPolicy resource type

Namespace: microsoft.graph.security


APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents a legal hold policy. Legal holds are holds that are tied to an eDiscovery case. Legal holds should not be confused with retention holds, which are used to control retention policies for Microsoft 365 content. eDiscovery legal holds are for holding content indefinitely for litigation, internal investigations, and other legal actions where content needs to be protected against deletion. For more information, see Manage holds in eDiscovery (Premium)


Method Return type Description
List ediscoveryHoldPolicies microsoft.graph.security.ediscoveryHoldPolicy collection Get a list of the ediscoveryHoldPolicy objects and their properties.
Create ediscoveryHoldPolicy microsoft.graph.security.ediscoveryHoldPolicy Create a new ediscoveryHoldPolicy object.
Get ediscoveryHoldPolicy microsoft.graph.security.ediscoveryHoldPolicy Read the properties and relationships of an ediscoveryHoldPolicy object.
Update ediscoveryHoldPolicy microsoft.graph.security.ediscoveryHoldPolicy Update the properties of an ediscoveryHoldPolicy object.
Delete ediscoveryHoldPolicy None Delete an ediscoveryHoldPolicy object.
List siteSources microsoft.graph.security.siteSource collection Get the siteSource resources from the siteSources navigation property.
Create siteSource microsoft.graph.security.siteSource Create a new siteSource object.
List userSources microsoft.graph.security.userSource collection Get the userSource resources from the userSources navigation property.
Create userSource microsoft.graph.security.userSource Create a new userSource object.


Property Type Description
contentQuery String KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank.
createdBy identitySet The user who created the legal hold.
createdDateTime DateTimeOffset The date and time the legal hold was created.
description String The legal hold description.
displayName String The display name of the legal hold.
errors String collection Lists any errors that happened while placing the hold.
id String The ID for the eDiscovery case. Read-only. Inherited from entity.
isEnabled Boolean Indicates whether the hold is enabled and actively holding content.
lastModifiedBy identitySet the user who last modified the legal hold.
lastModifiedDateTime DateTimeOffset The date and time the legal hold was last modified.
status microsoft.graph.security.policyStatus The status of the legal hold. Possible values are: Pending, Error, Success.

policyStatus values

Member Description
Pending The hold distribution process is in progress.
Error There was an error when the hold was applied.
Success The hold was successfully applied and is holding the specified content.


Relationship Type Description
siteSources microsoft.graph.security.siteSource collection Data sources that represent SharePoint sites.
userSources microsoft.graph.security.userSource collection Data sources that represent Exchange mailboxes.

JSON representation

The following is a JSON representation of the resource.

  "@odata.type": "#microsoft.graph.security.ediscoveryHoldPolicy",
  "id": "String (identifier)",
  "displayName": "String",
  "description": "String",
  "createdBy": {
    "@odata.type": "microsoft.graph.identitySet"
  "createdDateTime": "String (timestamp)",
  "lastModifiedBy": {
    "@odata.type": "microsoft.graph.identitySet"
  "lastModifiedDateTime": "String (timestamp)",
  "status": "String",
  "isEnabled": "Boolean",
  "contentQuery": "String",
  "errors": [