ediscoveryHoldPolicy resource type
Namespace: microsoft.graph.security
Important
APIs under the /beta
version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Represents a legal hold policy. Legal holds are holds that are tied to an eDiscovery case. Legal holds should not be confused with retention holds, which are used to control retention policies for Microsoft 365 content. eDiscovery legal holds are for holding content indefinitely for litigation, internal investigations, and other legal actions where content needs to be protected against deletion. For more information, see Manage holds in eDiscovery (Premium)
Methods
Method | Return type | Description |
---|---|---|
List | microsoft.graph.security.ediscoveryHoldPolicy collection | Get a list of the ediscoveryHoldPolicy objects and their properties. |
Create | microsoft.graph.security.ediscoveryHoldPolicy | Create a new ediscoveryHoldPolicy object. |
Get | microsoft.graph.security.ediscoveryHoldPolicy | Read the properties and relationships of an ediscoveryHoldPolicy object. |
Update | microsoft.graph.security.ediscoveryHoldPolicy | Update the properties of an ediscoveryHoldPolicy object. |
Delete | None | Delete an ediscoveryHoldPolicy object. |
List site sources | microsoft.graph.security.siteSource collection | Get the siteSource resources from the siteSources navigation property. |
Create site source | microsoft.graph.security.siteSource | Create a new siteSource object. |
List user sources | microsoft.graph.security.userSource collection | Get the userSource resources from the userSources navigation property. |
Create user source | microsoft.graph.security.userSource | Create a new userSource object. |
Properties
Property | Type | Description |
---|---|---|
contentQuery | String | KQL query that specifies content to be held in the specified locations. To learn more, see Keyword queries and search conditions for Content Search and eDiscovery. To hold all content in the specified locations, leave contentQuery blank. |
createdBy | identitySet | The user who created the legal hold. |
createdDateTime | DateTimeOffset | The date and time the legal hold was created. |
description | String | The legal hold description. |
displayName | String | The display name of the legal hold. |
contentQuery | String | KQL query that specifies content to be held in the specified locations. |
errors | String collection | Lists any errors that happened while placing the hold. |
id | String | The ID for the eDiscovery case. Read-only. Inherited from entity. |
isEnabled | Boolean | Indicates whether the hold is enabled and actively holding content. |
lastModifiedBy | identitySet | the user who last modified the legal hold. |
lastModifiedDateTime | DateTimeOffset | The date and time the legal hold was last modified. |
status | microsoft.graph.security.policyStatus | The status of the legal hold. Possible values are: Pending , Error , Success . |
policyStatus values
Member | Description |
---|---|
Pending | The hold distribution process is in progress. |
Error | There was an error when the hold was applied. |
Success | The hold was successfully applied and is holding the specified content. |
Relationships
Relationship | Type | Description |
---|---|---|
siteSources | microsoft.graph.security.siteSource collection | Data sources that represent SharePoint sites. |
userSources | microsoft.graph.security.userSource collection | Data sources that represent Exchange mailboxes. |
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.ediscoveryHoldPolicy",
"id": "String (identifier)",
"displayName": "String",
"description": "String",
"createdBy": {
"@odata.type": "microsoft.graph.identitySet"
},
"createdDateTime": "String (timestamp)",
"lastModifiedBy": {
"@odata.type": "microsoft.graph.identitySet"
},
"lastModifiedDateTime": "String (timestamp)",
"status": "String",
"isEnabled": "Boolean",
"contentQuery": "String",
"errors": [
"String"
]
}