Edit

Share via

ediscoveryCustodian resource type

Namespace: microsoft.graph.security

In the context of eDiscovery, represents a user and all of their digital assets, such as email and documents.

Methods

Method Return type Description
List microsoft.graph.security.ediscoveryCustodian collection Get a list of the ediscoveryCustodian objects and their properties.
Create microsoft.graph.security.ediscoveryCustodian Create a new ediscoveryCustodian object.
Get microsoft.graph.security.ediscoveryCustodian Read the properties and relationships of an ediscoveryCustodian object.
Update index Triggers a indexOperation to make a custodian and associated sources searchable.
Activate None Re-activate a custodian from a case.
Release None Release a custodian from a case.
Apply hold None Start the process of applying hold to eDiscovery custodians.
Remove hold None Start the process of removing hold from eDiscovery custodians.
Get last index operation microsoft.graph.security.ediscoveryIndexOperation collection Get a list of the ediscoveryIndexOperation associated with an ediscoveryCustodian.
Site sources
List microsoft.graph.security.siteSource collection Get a list of the siteSource objects associated with an ediscoveryCustodian.
Create microsoft.graph.security.siteSource Create a new siteSource object associated with an ediscoveryCustodian.
Delete None Delete a siteSource object associated with an ediscoveryCustodian.
Unified group sources
List microsoft.graph.security.unifiedGroupSource collection Get a list of the unifiedGroupSource objects associated with an ediscoveryCustodian.
Create microsoft.graph.security.unifiedGroupSource Create a new unifiedGroupSource object associated with an ediscoveryCustodian.
Delete None Delete a unifiedGroupSource object associated with an ediscoveryCustodian.
User sources
List microsoft.graph.security.userSource collection Get a list of the userSource objects associated with an ediscoveryCustodian or ediscoveryHoldPolicy.
Create microsoft.graph.security.userSource Create a new userSource object associated with an ediscoveryCustodian.
Delete None Delete a userSource object associated with an ediscoveryCustodian.

Properties

Property Type Description
acknowledgedDateTime DateTimeOffset Date and time the custodian acknowledged a hold notification.
createdDateTime DateTimeOffset Date and time when the custodian was added to the case.
displayName String Display name of the custodian.
email String Email address of the custodian.
holdStatus microsoft.graph.security.dataSourceHoldStatus The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial
id String The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime DateTimeOffset Date and time the custodian object was last modified
releasedDateTime DateTimeOffset Date and time the custodian was released from the case.
status microsoft.graph.security.custodianStatus Status of the custodian. The possible values are: active, released.

custodianStatus values

Name Description
active Custodian is an active part of the case.
released Custodian is released from the case.

custodianHoldStatus values

Name Description
notApplied The custodian is not on Hold (all sources in it are not on hold).
applied The custodian is on Hold (all sources are on hold).
applying The custodian is in applying hold state (applyHold operation triggered).
removing The custodian is in removing the hold state(removeHold operation triggered).
partial The custodian is in mixed state where some sources are on hold and some not on hold or error state.

Relationships

Relationship Type Description
lastIndexOperation microsoft.graph.security.ediscoveryIndexOperation Operation entity that represents the latest indexing for the custodian.
siteSources microsoft.graph.security.siteSource collection Data source entity for SharePoint sites associated with the custodian.
unifiedGroupSources microsoft.graph.security.unifiedGroupSource collection Data source entity for groups associated with the custodian.
userSources microsoft.graph.security.userSource collection Data source entity for a the custodian. This is the container for a custodian's mailbox and OneDrive for Business site.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.ediscoveryCustodian",
  "id": "String (identifier)",
  "status": "String",
  "holdStatus": "String",
  "lastModifiedDateTime": "String (timestamp)",
  "releasedDateTime": "String (timestamp)",
  "displayName": "String",
  "createdDateTime": "String (timestamp)",
  "email": "String",
  "acknowledgedDateTime": "String (timestamp)"
}
  • Last updated on