ediscoveryCustodian resource type
Namespace: microsoft.graph.security
In the context of eDiscovery, represents a user and all of their digital assets, such as email and documents.
Methods
| Method | Return type | Description |
|---|---|---|
| List | microsoft.graph.security.ediscoveryCustodian collection | Get a list of the ediscoveryCustodian objects and their properties. |
| Create | microsoft.graph.security.ediscoveryCustodian | Create a new ediscoveryCustodian object. |
| Get | microsoft.graph.security.ediscoveryCustodian | Read the properties and relationships of an ediscoveryCustodian object. |
| Update index | Triggers a indexOperation to make a custodian and associated sources searchable. | |
| Activate | None | Re-activate a custodian from a case. |
| Release | None | Release a custodian from a case. |
| Apply hold | None | Start the process of applying hold to eDiscovery custodians. |
| Remove hold | None | Start the process of removing hold from eDiscovery custodians. |
| Get last index operation | microsoft.graph.security.ediscoveryIndexOperation collection | Get a list of the ediscoveryIndexOperation associated with an ediscoveryCustodian. |
| List site sources | microsoft.graph.security.siteSource collection | Get the siteSource resources from the siteSources navigation property. |
| Create site source | microsoft.graph.security.siteSource | Create a new siteSource object associated with an eDiscovery custodian. |
| List unified group sources | microsoft.graph.security.unifiedGroupSource collection | Get the unifiedGroupSource resources from the unifiedGroupSources navigation property. |
| Create unified group source | microsoft.graph.security.unifiedGroupSource | Create a new unifiedGroupSource object associated with an eDiscovery custodian. |
| List user sources | microsoft.graph.security.userSource collection | Get the userSource resources from the userSources navigation property. |
| Create user source | microsoft.graph.security.userSource | Create a new userSource object associated with an eDiscovery custodian. |
Properties
| Property | Type | Description |
|---|---|---|
| acknowledgedDateTime | DateTimeOffset | Date and time the custodian acknowledged a hold notification. |
| createdDateTime | DateTimeOffset | Date and time when the custodian was added to the case. |
| displayName | String | Display name of the custodian. |
| String | Email address of the custodian. | |
| holdStatus | microsoft.graph.security.dataSourceHoldStatus | The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial |
| id | String | The ID for the custodian in the specified case. Read-only. |
| lastModifiedDateTime | DateTimeOffset | Date and time the custodian object was last modified |
| releasedDateTime | DateTimeOffset | Date and time the custodian was released from the case. |
| status | microsoft.graph.security.custodianStatus | Status of the custodian. Possible values are: active, released. |
custodianStatus values
| Name | Description |
|---|---|
| active | Custodian is an active part of the case. |
| released | Custodian is released from the case. |
custodianHoldStatus values
| Name | Description |
|---|---|
| notApplied | The custodian is not on Hold (all sources in it are not on hold). |
| applied | The custodian is on Hold (all sources are on hold). |
| applying | The custodian is in applying hold state (applyHold operation triggered). |
| removing | The custodian is in removing the hold state(removeHold operation triggered). |
| partial | The custodian is in mixed state where some sources are on hold and some not on hold or error state. |
Relationships
| Relationship | Type | Description |
|---|---|---|
| lastIndexOperation | microsoft.graph.security.ediscoveryIndexOperation | Operation entity that represents the latest indexing for the custodian. |
| siteSources | microsoft.graph.security.siteSource collection | Data source entity for SharePoint sites associated with the custodian. |
| unifiedGroupSources | microsoft.graph.security.unifiedGroupSource collection | Data source entity for groups associated with the custodian. |
| userSources | microsoft.graph.security.userSource collection | Data source entity for a the custodian. This is the container for a custodian's mailbox and OneDrive for Business site. |
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.ediscoveryCustodian",
"id": "String (identifier)",
"status": "String",
"holdStatus": "String",
"lastModifiedDateTime": "String (timestamp)",
"releasedDateTime": "String (timestamp)",
"displayName": "String",
"createdDateTime": "String (timestamp)",
"email": "String",
"acknowledgedDateTime": "String (timestamp)"
}