ediscoveryCustodian resource type

Namespace: microsoft.graph.security

In the context of eDiscovery, represents a user and all of their digital assets, such as email and documents.

Methods

Method	Return type	Description
List ediscoveryCustodians	microsoft.graph.security.ediscoveryCustodian collection	Get a list of the ediscoveryCustodian objects and their properties.
Create ediscoveryCustodian	microsoft.graph.security.ediscoveryCustodian	Create a new ediscoveryCustodian object.
Get ediscoveryCustodian	microsoft.graph.security.ediscoveryCustodian	Read the properties and relationships of an ediscoveryCustodian object.
updateIndex	Triggers a indexOperation to make a custodian and associated sources searchable.
activate	None	Re-activate a custodian from a case.
release	None	Release a custodian from a case.
applyHold	None	Start the process of applying hold to eDiscovery custodians.
removeHold	None	Start the process of removing hold from eDiscovery custodians.
List ediscoveryIndexOperation	microsoft.graph.security.ediscoveryIndexOperation collection	Get a list of the ediscoveryIndexOperation associated with an ediscoveryCustodian.
List siteSources	microsoft.graph.security.siteSource collection	Get the siteSource resources from the siteSources navigation property.
Create siteSource	microsoft.graph.security.siteSource	Create a new siteSource object associated with an eDiscovery custodian.
List unifiedGroupSources	microsoft.graph.security.unifiedGroupSource collection	Get the unifiedGroupSource resources from the unifiedGroupSources navigation property.
Create unifiedGroupSource	microsoft.graph.security.unifiedGroupSource	Create a new unifiedGroupSource object associated with an eDiscovery custodian.
List userSources	microsoft.graph.security.userSource collection	Get the userSource resources from the userSources navigation property.
Create userSource	microsoft.graph.security.userSource	Create a new userSource object associated with an eDiscovery custodian.

Properties

Property	Type	Description
acknowledgedDateTime	DateTimeOffset	Date and time the custodian acknowledged a hold notification.
createdDateTime	DateTimeOffset	Date and time when the custodian was added to the case.
displayName	String	Display name of the custodian.
email	String	Email address of the custodian.
holdStatus	microsoft.graph.security.dataSourceHoldStatus	The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial
id	String	The ID for the custodian in the specified case. Read-only.
lastModifiedDateTime	DateTimeOffset	Date and time the custodian object was last modified
releasedDateTime	DateTimeOffset	Date and time the custodian was released from the case.
status	microsoft.graph.security.custodianStatus	Status of the custodian. Possible values are: active, released.

custodianStatus values

Name	Description
active	Custodian is an active part of the case.
released	Custodian is released from the case.

custodianHoldStatus values

Name	Description
notApplied	The custodian is not on Hold (all sources in it are not on hold).
applied	The custodian is on Hold (all sources are on hold).
applying	The custodian is in applying hold state (applyHold operation triggered).
removing	The custodian is in removing the hold state(removeHold operation triggered).
partial	The custodian is in mixed state where some sources are on hold and some not on hold or error state.

Relationships

Relationship	Type	Description
lastIndexOperation	microsoft.graph.security.ediscoveryIndexOperation	Operation entity that represents the latest indexing for the custodian.
siteSources	microsoft.graph.security.siteSource collection	Data source entity for SharePoint sites associated with the custodian.
unifiedGroupSources	microsoft.graph.security.unifiedGroupSource collection	Data source entity for groups associated with the custodian.
userSources	microsoft.graph.security.userSource collection	Data source entity for a the custodian. This is the container for a custodian's mailbox and OneDrive for Business site.

JSON representation

The following is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.security.ediscoveryCustodian",
  "id": "String (identifier)",
  "status": "String",
  "holdStatus": "String",
  "lastModifiedDateTime": "String (timestamp)",
  "releasedDateTime": "String (timestamp)",
  "displayName": "String",
  "createdDateTime": "String (timestamp)",
  "email": "String",
  "acknowledgedDateTime": "String (timestamp)"
}