Edit

Update case management case

Namespace: microsoft.graph.security.caseManagement

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Update the properties of a microsoft.graph.security.caseManagement.case object.

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permission Higher privileged permissions
Delegated (work or school account) Not supported. Not supported.
Delegated (personal Microsoft account) Not supported. Not supported.
Application Not supported. Not supported.

Important

For delegated access using work or school accounts, the signed-in user must be assigned a supported Microsoft Entra role or a custom role that grants the permissions required for this operation. This API supports the following built-in roles:

  • Security Reader
  • Security Operator
  • Security Administrator

HTTP request

PATCH /security/caseManagement/cases/{caseId}

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

In the request body, supply only the values for properties to update. Existing properties that aren't included in the request body maintain their previous values or are recalculated based on changes to other property values.

The following table specifies the properties that can be updated.

Supply a JSON representation of the resource. For polymorphic resources, include @odata.type to identify the concrete case type. The properties that can be updated depend on the case type.

The following properties can be updated for all case types.

Property Type Description
displayName String The display name of the case.
status String The lifecycle status of the case.

For genericCase objects, you can also update the following properties.

Property Type Description
assignedTo String The user assigned to the generic case.
closingNotes String Notes recorded when the generic case is closed.
description String The description of the generic case.
dueDateTime DateTimeOffset The target completion date and time for the generic case.
priority String The priority assigned to the generic case.

For incidentCase objects, you can also update the following properties. Changes to incident case properties might be synchronized with the related incident.

Property Type Description
classification microsoft.graph.security.caseManagement.incidentClassification The classification assigned to the incident.
determination microsoft.graph.security.caseManagement.incidentDetermination The determination assigned to the incident.
emailNotificationRecipients String collection The email notification recipients for the incident.
priorityScore Int32 The priority score assigned to the incident.
severity microsoft.graph.security.caseManagement.incidentSeverity The severity assigned to the incident.
summary String A summary of the incident.

Response

If successful, this method returns one of the following response codes:

  • For incidentCase objects, changes might be synchronized with the related incident. As a result, this method returns a 202 Accepted response code, and the changes might take a few minutes to apply.
  • For other case types, this method returns a 200 OK response code and an updated microsoft.graph.security.caseManagement.case object in the response body.

Examples

Example 1: Update a generic case

Request

The following example shows a request.

PATCH https://graph.microsoft.com/beta/security/caseManagement/cases/{caseId}
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.security.caseManagement.genericCase",
  "displayName": "Case MS-001",
  "status": "Open",
  "description": "Investigating potential credential compromise.",
  "assignedTo": "john.doe@contoso.com",
  "priority": "high",
  "dueDateTime": "2026-06-29T17:54:43Z",
  "closingNotes": "Follow up with the account owner."
}

Response

The following example shows the response.

HTTP/1.1 200 OK
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.security.caseManagement.genericCase",
  "id": "987757fb-6ef4-1061-17e7-9de0d088e1dd",
  "createdDateTime": "2026-05-20T11:12:28Z",
  "createdBy": "user@contoso.com",
  "lastModifiedDateTime": "2026-05-20T11:18:45Z",
  "lastModifiedBy": "user@contoso.com",
  "displayName": "Case MS-001",
  "status": "Open",
  "description": "Investigating potential credential compromise.",
  "assignedTo": "john.doe@contoso.com",
  "priority": "high",
  "dueDateTime": "2026-06-29T17:54:43Z",
  "closingNotes": "Follow up with the account owner."
}

Example 2: Update an incident case

Request

The following example shows a request.

PATCH https://graph.microsoft.com/beta/security/caseManagement/cases/{caseId}
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.security.caseManagement.incidentCase",
  "displayName": "Incident Case MS-002",
  "status": "InProgress",
  "classification": "truePositive",
  "determination": "phishing",
  "severity": "high",
  "summary": "Credential phishing campaign affecting multiple users."
}

Response

The following example shows the response.

HTTP/1.1 202 Accepted
  • Last updated on