Codex Purview primary-source snapshot, September 14, 2026

New immutable source capture. Vendor-authored text retrieved through Microsoft Learn; not a customer tenant extract or a Codex deliverable. Relative links inside source text are relative to each original URL. Sources are retained to preserve documentation conflicts; their text is not an adopted implementation recipe.

Source 1: Use the Microsoft Purview eDiscovery API

Original URL: https://learn.microsoft.com/graph/api/resources/security-ediscovery-apioverview?view=graph-rest-1.0

Accessed: 2026-09-14

Use the Microsoft Purview eDiscovery API

The Microsoft Purview APIs for eDiscovery enable organizations to automate repetitive tasks and integrate with their existing eDiscovery tools to build repeatable workflows that industry regulations might require. You can use the eDiscovery APIs to help with your legal needs.

• The Microsoft Purview APIs for eDiscovery are intended for the use of eDiscovery operations for litigation, investigation, and regulatory requests. These APIs shouldn't be used as a substitute for journaling data out of the Microsoft 365 system or any other mass download.
• For information about setting up app-only access, see Set up application authentication.
• The eDiscovery APIs in Microsoft Graph are available to organizations with E3 and E5 subscriptions. The authentication method and available operations depend on your subscription tier. Organizations with an E3 subscription can use delegated (user) authentication to automate standard eDiscovery operations. App-only authentication and premium operations require E5 or an equivalent add-on subscription. For more information, see Learn about eDiscovery: Features and capabilities.

Feature	E3/Standard with delegated auth	E5/Premium with delegated auth	E5/Premium with app-only auth
Cases, Searches, Holds	Yes	Yes	Yes
Export	Requires pay-as-you-go billing	Yes	Yes
Premium features incl: Review sets, tagging, analytics	No	Yes	Yes

Name	Type	Use case
Case	microsoft.graph.security.ediscoverycase	The container for all eDiscovery objects including custodians, holds, searches, review sets, and exports.
Case settings	microsoft.graph.security.ediscoveryCaseSettings	The settings associated with the case.
Custodian	microsoft.graph.security.ediscoveryCustodian	A person and the data they have administrative control over. When custodians are identified, eDiscovery can hold, search, cull, and export their data. For details, see Work with custodians and noncustodial data sources in eDiscovery.
Non custodial data source	microsoft.graph.security.ediscoveryNoncustodialDataSource	The data sources to be added to a case without having to associate it to a custodian. When non custodial data sources are identified, eDiscovery can hold, search, cull, and export their data. For details, see Work with custodians and noncustodial data sources in eDiscovery.
Search	microsoft.graph.security.ediscoverySearch	Allows you to collect data from the Microsoft 365 live services such as Exchange, SharePoint, and Teams. Source collections can be added to a review set to further cull and eventually export data relevant to your case. For details, see Collect data for a case in eDiscovery.
Legal hold	microsoft.graph.security.ediscoveryHoldPolicy	Content held for litigation and legal purposes. Legal holds shouldn't be confused with or used as retention holds, which are typically used to comply with government or industry regulations. To learn more, see Manage holds in eDiscovery.
Operation	microsoft.graph.security.caseOperation	Operations which can be performed on a case like adding to review set, applying tags, and so on.
Review set	microsoft.graph.security.ediscoveryReviewSet	The static set of electronically stored information collected for use in a litigation, investigation, or regulatory request.
Tags	microsoft.graph.security.ediscoveryReviewTag	Used in a review set during review or culling to cull responsive data from nonresponsive data, identify privileged content, or generally aid in the review process. To learn more, see Tag documents in a review set in eDiscovery.

Source 2: Use Microsoft Purview APIs for eDiscovery

Original URL: https://learn.microsoft.com/purview/edisc-ref-api-guide

Accessed: 2026-09-14

Use Microsoft Purview APIs for eDiscovery

The Microsoft Purview Application Programming Interface (API) for eDiscovery in Microsoft Graph enables your organization to automate repetitive tasks and integrate with your existing eDiscovery tools to build repeatable workflows that industry regulations might require. This article provides guidance on how to configure the required prerequisites to enable access to the Microsoft Purview APIs for eDiscovery. This guidance is based on using app-only access to the APIs, with either a client secret or a self-signed certificate to authenticate the requests.

Microsoft Purview APIs

The Microsoft Purview APIs for eDiscovery include two separate APIs:

• Microsoft Graph: Part of the Microsoft.Graph.Security namespace and used for working with eDiscovery cases.
• Microsoft Purview eDiscovery API: Used exclusively to programmatically download packages created when exporting from searches and review sets in eDiscovery.

eDiscovery APIs in Microsoft Graph support eDiscovery cases with and without premium features enabled. Delegated authentication supports core eDiscovery capabilities such as cases, holds, searches, and exports. App-only authentication is available for cases with premium features enabled and supports advanced operations such as review sets, tagging, and analytics.

For a list of supported API calls within the Microsoft Graph calls, see Use the Microsoft Purview eDiscovery API.

Application access to data

Before you can make any calls to the Microsoft Purview APIs for eDiscovery, you must first register an app in the Microsoft Identity Platform, Entra ID.

An application can access data in two ways:

• Delegated access: An app acting on behalf of a signed-in user.
• App-only access: An app acting with its own identity.

For more information about access scenarios, see Authentication and authorization basics.

Important

App-only authentication requires an eDiscovery case with premium features enabled. Delegated authentication is available for core eDiscovery capabilities including cases, legal holds, searches, and exports. Premium API operations (review sets, tagging, analytics) require premium features enabled regardless of authentication method. For more information about subscription requirements, see subscription requirements for eDiscovery.

Microsoft Graph API

Prerequisites for Microsoft Graph API

Implementing app-only accessinvolves registering an app in Azure portal, creating client secret/certificates, assigning API permissions, setting up a service principal, and then using app-only access to call Microsoft Graph APIs. To register an app, create client secret/certificates and assign API permissions the account must be a Cloud Application Administrator.

For more information about registering an app in the Azure portal, see Register an application with the Microsoft identity platform.

Granting tenant-wide admin consent for Microsoft Purview eDiscovery API application permissions requires you to sign in as a user that is authorized to consent on behalf of your organization. For more information, see Grant tenant-wide admin consent to an application.

Setting up a service principal requires the following prerequisites:

• A machine with the ExchangeOnlineManagement module installed.
• An account that has the Role Management role assigned in Microsoft Purview.

For detailed steps on implementing app-only access for eDiscovery, see Set up app-only access for Microsoft Purview eDiscovery.

Connecting to Microsoft Graph API using app-only access

Use the Connect-MgGraph cmdlet in PowerShell to authenticate and connect to Microsoft Graph using the app-only access method. This cmdlet enables your app to interact with Microsoft Graph securely and enables you to explore the Microsoft Purview eDiscovery APIs.

Connecting via client secret

To connect using a client secret, update and run the following example PowerShell code.

$clientSecret = "<client secret>" ## Update with client secret added to the registered app
$appID = "<APP ID>" ## Update with Application ID of registered/Enterprise app
$tenantId = "<Tenant ID>" ## Update with tenant ID
$ClientSecretPW = ConvertTo-SecureString "$clientSecret" -AsPlainText -Force
$clientSecretCred = New-Object System.Management.Automation.PSCredential -ArgumentList ("$appID", $clientSecretPW)
Connect-MgGraph -TenantId "$tenantId" -ClientSecretCredential $clientSecretCred

Connecting via certificate

To connect using a certificate, update and run the following example PowerShell code.

$certPath = "Cert:\currentuser\my\<xxxxxxxxxx>" ## Update with the cert thumbnail
$appID = "<APP ID>" ## Update with Application ID of registered/Enterprise app
$tenantId = "<Tenant ID>" ## Update with tenant ID
$ClientCert = Get-ChildItem $certPath
Connect-MgGraph -TenantId $TenantId -ClientId $appId -Certificate $ClientCert

Invoke Microsoft Graph API calls

After you connect, you can start making calls to the Microsoft Graph API.

For example, you can list the eDiscovery cases within the tenant by using the ediscoveryCases API. The guidance for each operation lists the following information:

• Permissions required to make the API call
• HTTP request and method
• Request header and body information
• Response
• Examples (HTTP, C#, CLI, Go, Java, PHP, PowerShell, Python)

Because you're connected through the Microsoft Graph PowerShell module, you can use either the HTTP or PowerShell method.

First, let's look at the PowerShell example.

PowerShell example for list of eDiscovery cases (image in original source)

As you can see, it returns a list of all the cases within the tenant. When delving deeper into a case, it's important to record the case ID. You need this ID for future API calls.

Now, let's look at an HTTP example. You use the Invoke-MgGraphRequest cmdlet to make the call by using PowerShell.

First, store the URL in a variable:

$uri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases"

Then use the Invoke-MgGraphRequest cmdlet to make the API call.

Invoke-MgGraphRequest -Method Get -Uri $uri

As you can see from the following output, you need to extract the values from the returned response.

PowerShell example for URL output (image in original source)

You can save the Value elements of the response to a new variable by using the following command.

$cases = (Invoke-MgGraphRequest -Method Get -Uri $uri).value

PowerShell example for extracting URL (image in original source)

PowerShell example for extracting URL for cases (image in original source)

This command returns a collection of hash tables. Optionally, you can run a small bit of PowerShell code to convert the hash tables into PowerShell objects for easier use with cmdlet parameters such as format-table and format-list.

$CasesAsObjects = @()
foreach($i in $cases) {$CasesAsObjects += [pscustomobject]$i}
$CasesAsObjects | ft displayname,id,status

PowerShell example to convert hash tables (image in original source)

Microsoft Purview eDiscovery API

You can configure the Microsoft Purview eDiscovery API to enable the programmatic download of export packages and the reports from an export process in an eDiscovery case.

Prerequisites for Microsoft Purview eDiscovery API

Before you execute the configuration steps in this section, complete and validate the configuration detailed in the Microsoft Graph API section. Extend the previously registered app in Microsoft Entra ID to include the required permissions to achieve programmatic download of the export package.

This configuration already provides the following prerequisites:

• Registered app in Azure portal configured with the appropriate client secret or certificate.
• Service principal in Microsoft Purview assigned the relevant eDiscovery roles.
• Microsoft eDiscovery API permissions configured for the Microsoft Graph.

To extend the existing registered app's API permissions to enable programmatic download, complete the following steps:

• Register a new Microsoft Application and service principal in the tenant.
• Assign additional API permissions to the previously registered app in the Azure portal.

To grant tenant-wide admin consent for Microsoft Purview eDiscovery APIs application permissions, sign in as a user that is authorized to consent on behalf of the organization. For more information, see Grant tenant-wide admin consent to an application.

Configuration steps

Step 1: Register the MicrosoftPurviewEDiscovery app in Microsoft Entra ID

Complete the following steps:

1. Validate that the MicrosoftPurviewEDiscovery app isn't already registered. Sign in to the Azure portal and go to Microsoft Entra ID > Enterprise Applications.

2. Change the Application type filter to show Microsoft Applications.

3. In the search box, enter MicrosoftPurviewEDiscovery. The MicrosoftPurviewEDiscovery app should be displayed. If the MicrosoftPurviewEDiscovery app isn't listed, register the app in Microsoft Entra ID.

   To register the app, complete the following steps:

   • Use the Microsoft.Graph PowerShell Module to register the MicrosoftPurviewEDiscovery app in Microsoft Entra ID. For more information, see Install the Microsoft Graph PowerShell SDK.
   • After the module is installed on a machine, run the following cmdlet to connect to Microsoft Graph using PowerShell:

   Connect-MgGraph -scopes "Application.ReadWrite.All"

   If this is the first time using Microsoft Graph PowerShell cmdlets, you might be prompted to consent to required permissions.

   To register the MicrosoftPurviewEDiscovery app, run the following PowerShell commands:

   $spId = @{"AppId" = "b26e684c-5068-4120-a679-64a5d2c909d9" }

   New-MgServicePrincipal -BodyParameter $spId;

Note

Use the PowerShell script to register a new application in Microsoft Entra ID and assign the Microsoft Purview eDiscovery API permissions for application authentication if applicable. After you register the application, you need to configure the client secret or certificate and grant admin consent through the portal.

Step 2: Assign additional MicrosoftPurviewEDiscovery permissions to the registered app

Now that the service principal is added, update the permissions on your previously registered app created in the Microsoft Graph API section of this article. Sign in to the Azure portal and go to Microsoft Entra ID > App Registrations.

1. Find and select the app you created in the Microsoft Graph API section of this article.
2. Select API Permissions from the navigation menu.
3. Select Add a permission and then APIs my organization uses.
4. Search for MicrosoftPurviewEDiscovery and select it.
5. Select Application Permissions.
6. Select the check box for eDiscovery.Download.Read.
7. Select Add Permissions.
8. On API permissions, select Grant Admin Consent (your organization) to approve the added permissions.

After admin consent is granted, the status of the added permissions is updated for your organization.

Downloading the export packages and reports

Retrieving the case ID and export job ID

To download the export packages and reports of an export process in an eDiscovery case, you need the case ID and the operation or job ID for the export job.

To gather this information by using the Microsoft Purview portal:

• Open an eDiscovery case.
• Locate the export process.
• Select Copy support information.
• Add this information into a text editor (like Notepad).

Alternatively, access this information programmatically by using the following Graph API calls to locate the case ID and the job ID you want to export:

1. Connect to Microsoft Graph by following the steps in the Connecting to Microsoft Graph API using app-only access section of this article.

2. Use the eDiscovery Graph PowerShell cmdlets with the following command if you know the case name:

   Get-MgSecurityCaseEdiscoveryCase | where {$_.displayname -eq "<Name of case>"}

3. After you have the case ID, look up the operations in the case to identify the job ID for the export by using the following command:

   Get-MgSecurityCaseEdiscoveryCaseOperation -EdiscoveryCaseId "<case ID>"

Export jobs are logged under an action of exportResult for a direct export from search or ContentExport for an export from a review set. The name of the export jobs isn't returned by this API call. To find the name of the export process, you must query the specific operation ID. Use the following command to find the name of the export process:

Get-MgSecurityCaseEdiscoveryCaseOperation -EdiscoveryCaseId "<case ID>" -CaseOperationId “<operation ID>”

The name of the export operation is included in the AdditionalProperties field.

To make the HTTP API calls directly to list cases in your organization, see List ediscoveryCases.

To make the HTTP API calls directly to list the operations for a case, see List caseOperations.

Use the case ID in the API call to indicate which case to list the operations from. For example:

https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/<CaseID>/operations/

The name of the export jobs isn't returned with this API call. To find the name of the export process, you must query the specific job ID. For example:

https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/<CaseID>/operations/<OperationID>

Downloading an export package

Retrieving the download URLs for export packages

The exportFileMetaData property contains the URL you need to download the export packages and reports. To get the URL, you need the case ID of the eDiscovery case where you ran the export process and the operation ID for the export process.

Use the following eDiscovery Graph PowerShell cmdlets to find this information:

$operation = Get-MgSecurityCaseEdiscoveryCaseOperation -EdiscoveryCaseId "<case ID>" -CaseOperationId “<operation ID>”

$Operation.AdditionalProperties.exportFileMetadata

To make the HTTP API calls directly to return the exportFileMetaData information for an operation, see List caseOperations.

Each export package in the Microsoft Purview portal has an entry in the exportFileMetaData property. Each entry lists the following information:

• The export package file name
• The downloadUrl to retrieve the export package
• The size of the export package

Example scripts to download the export package

Because the Microsoft Purview eDiscovery API is separate from Microsoft Graph API, you need a separate authentication token to authorize a download request. Use the MSAL.PS PowerShell Module and the Get-MSALToken cmdlet to get a separate token. You also need to connect to the Microsoft Graph APIs by using the Connect-MgGraph cmdlet.

The following example scripts can be used as a reference when developing your own scripts to enable the programmatic download of the export packages.

Connecting with a client secret

If you configured your app to use a client secret, use the following example script as a reference to download the export package and reports programmatically. Copy the contents into Notepad and save it as DownloadExportUsingApp.ps1.

[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [string]$tenantId,
    [Parameter(Mandatory = $true)]
    [string]$appId,
    [Parameter(Mandatory = $true)]
    [string]$appSecret,
    [Parameter(Mandatory = $true)]
    [string]$caseId,
    [Parameter(Mandatory = $true)]
    [string]$exportId,
    [Parameter(Mandatory = $true)]
    [string]$path = "D:\Temp",
    [ValidateSet($null, 'USGov', 'USGovDoD')]
    [string]$environment = $null
)

if (-not(Get-Module -Name Microsoft.Graph -ListAvailable)) {
    Write-Host "Installing Microsoft.Graph module"
    Install-Module Microsoft.Graph -Scope CurrentUser
}

if (-not(Get-Module -Name MSAL.PS -ListAvailable)) {
    Write-Host "Installing MSAL.PS module"
    Install-Module MSAL.PS -Scope CurrentUser
}

$password = ConvertTo-SecureString $appSecret -AsPlainText -Force
$clientSecretCred = New-Object System.Management.Automation.PSCredential -ArgumentList ($appId, $password)

if (-not(Get-MgContext)) {
    Write-Host "Connect with credentials of a ediscovery admin (token for graph)"
    if (-not($environment)) {
        Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $clientSecretCred
    }
    else {
        Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $clientSecretCred -Environment $environment
    }
}

Write-Host "Connect with credentials of a ediscovery admin (token for export)"
$exportToken = Get-MsalToken -ClientId $appId -Scopes "00001111-aaaa-2222-bbbb-3333cccc4444/.default" -TenantId $tenantId -RedirectUri "http://localhost" -ClientSecret $password

$uri = "/v1.0/security/cases/ediscoveryCases/$($caseId)/operations/$($exportId)"

$export = Invoke-MgGraphRequest -Uri $uri;
if (-not($export)){
    Write-Host "Export not found"
    exit
}
else{
    $export.exportFileMetadata | % {
        Write-Host "Downloading $($_.fileName)"
        Invoke-WebRequest -Uri $_.downloadUrl -OutFile "$($path)\$($_.fileName)" -Headers @{"Authorization" = "Bearer $($exportToken.AccessToken)"; "X-AllowWithAADToken" = "true" }
    }
}

Save the script and open a new PowerShell window with the following PowerShell modules installed:

• Microsoft.Graph
• MSAL.PS

Browse to the directory where you saved the script and run the following command:

.\DownloadExportUsingApp.ps1 -tenantId “<tenant ID>” -appId “<App ID>” -appSecret “<Client Secret>” -caseId “<CaseID>” -exportId “<ExportID>” -path “<Output Path>”

Review the folder you specified as the path to view the downloaded files.

Connecting with a certificate

If you configured your app to use a certificate, use the following example script as a reference to download the export package and reports programmatically. Copy the contents into a text editor and save it as DownloadExportUsingAppCert.ps1.

[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [string]$tenantId,
    [Parameter(Mandatory = $true)]
    [string]$appId,
    [Parameter(Mandatory = $true)]
    [String]$certPath,
    [Parameter(Mandatory = $true)]
    [string]$caseId,
    [Parameter(Mandatory = $true)]
    [string]$exportId,
    [Parameter(Mandatory = $true)]
    [string]$path = "D:\Temp",
    [ValidateSet($null, 'USGov', 'USGovDoD')]
    [string]$environment = $null
)

if (-not(Get-Module -Name Microsoft.Graph -ListAvailable)) {
    Write-Host "Installing Microsoft.Graph module"
    Install-Module Microsoft.Graph -Scope CurrentUser
}

if (-not(Get-Module -Name MSAL.PS -ListAvailable)) {
    Write-Host "Installing MSAL.PS module"
    Install-Module MSAL.PS -Scope CurrentUser
}

##$password = ConvertTo-SecureString $appSecret -AsPlainText -Force
##$clientSecretCred = New-Object System.Management.Automation.PSCredential -ArgumentList ($appId, $password)

$ClientCert = Get-ChildItem $certPath

if (-not(Get-MgContext)) {
    Write-Host "Connect with credentials of a ediscovery admin (token for graph)"
    if (-not($environment)) {
        Connect-MgGraph -TenantId $TenantId -ClientId $appId -Certificate $ClientCert
    }
    else {
        Connect-MgGraph -TenantId $TenantId -ClientId $appId -Certificate $ClientCert -Environment $environment
    }
}

Write-Host "Connect with credentials of a ediscovery admin (token for export)"

$connectionDetails = @{
    'TenantId'          = $tenantId
    'ClientId'          = $appID
    'ClientCertificate' = $ClientCert
    'Scope' = "00001111-aaaa-2222-bbbb-3333cccc4444/.default"
}

$exportToken = Get-MsalToken @connectionDetails

$uri = "/v1.0/security/cases/ediscoveryCases/$($caseId)/operations/$($exportId)"

$export = Invoke-MgGraphRequest -Uri $uri;
if (-not($export)){
    Write-Host "Export not found"
    exit
}
else{
    $export.exportFileMetadata | % {
        Write-Host "Downloading $($_.fileName)"
        Invoke-WebRequest -Uri $_.downloadUrl -OutFile "$($path)\$($_.fileName)" -Headers @{"Authorization" = "Bearer $($exportToken.AccessToken)"; "X-AllowWithAADToken" = "true" }
    }
}

When you save the script, open a new PowerShell window with the following PowerShell modules installed:

• Microsoft.Graph
• MSAL.PS

Browse to the directory where you saved the script and run the following command.

.\DownloadExportUsingAppCert.ps1 -tenantId “<tenant ID>” -appId “<App ID>” -certPath “<Certificate Path>” -caseId “<CaseID>” -exportId “<ExportID>” -path “<Output Path>”

Review the folder you specified as the path to view the downloaded files.

Source 3: Set up app-only access for Microsoft Purview eDiscovery

Original URL: https://learn.microsoft.com/en-us/graph/security-ediscovery-appauthsetup

Accessed: 2026-09-14

Set up app-only access for Microsoft Purview eDiscovery

The Microsoft Purview APIs for eDiscovery in Microsoft Graph enable organizations to automate repetitive tasks and integrate with their existing eDiscovery tools to build repeatable workflows that industry regulations might require.

To better ensure secure and efficient access to resources, you can implement app-only access by using the Microsoft Graph API. This article walks you through how to set up app-only access for Microsoft Purview eDiscovery to help ensure that your applications are compliant and secure.

Why app-only access?

Enhancing security and compliance

App-only access enhances the security landscape of Microsoft Purview eDiscovery by implementing robust authentication protocols that standard user credentials can't match. By using application (client) IDs and certificates for authentication, you minimize the risk of credential theft, which is a common vulnerability in standard authentication methods. This approach not only helps to secure the application against unauthorized access, but also better ensures that the data integrity is maintained during the eDiscovery process.

Streamlining access and integration

App-only access streamlines the integration of eDiscovery services with other applications and systems. It facilitates automated, script-based interactions that are crucial for large-scale legal investigations and compliance audits. By allowing secure, token-based access to eDiscovery resources, organizations can automate workflows, reduce manual errors, and ensure consistent enforcement of compliance policies across all digital environments.

Implement app-only access

Implementing app-only access involves registering the app in Azure portal, creating client secret/certificates, assigning API permissions, setting up a service principal, and then using app-only access to call Microsoft Graph APIs. The following steps explain how to implement app-only access.

Step 1: Register a new application in Azure

1. Go to the Azure portal and sign in with your Microsoft account.
2. On the left pane of the Azure portal, select Microsoft Entra ID.
3. On the left pane, expand App registrations, and select New registration.
4. Provide a meaningful name for your application and select Register to create your new app registration. This process generates essential details such as the Application (client) ID and Directory (tenant) ID, which are important for the next steps.

You can now see the newly created app registration and the details.

Screenshot of the app registration page (image in original source)

Step 2: Create client secrets or certificates

Now that your app is registered, on the left pane in the Azure portal, expand Manage, and then select Certificates & secrets. Here, you can create a client secret or upload a certificate, depending on your authentication needs:

For a client secret, select New client secret, add a description, and select Add to save it. Make sure to copy and securely store the secret value for authentication later. Otherwise, you might have to create a new secret.

You can optionally upload a certificate to use along with the application ID for automation purposes.

Screenshot of the app registration client secret page (image in original source)

Step 3: Assign API permissions

You need to set the correct API permissions for your application. Expand Manage and select API permissions, then add eDiscovery.Read.All and eDiscovery.ReadWrite.All. These permissions enable your app to read and write eDiscovery data, respectively. The tenant admin must consent to these application permissions to enable them for use.

Screenshot of the app registration api permissions page (image in original source)

Step 4: Set up a service principal

1. Permission assignments for your app come in two parts - Microsoft Graph-level permissions, which you have already granted, and Purview-level case and role permissions. To do this, you need the object ID of your application. This value is different from the appId (named client ID in the Microsoft Entra admin center). To retrieve the app object ID, open the Azure portal > in the Microsoft Entra ID section > select Enterprise applications > search for your application by name and get the Object ID associated with your application from the list.

Screenshot of the enterprise applications page (image in original source)

1. Open a new PowerShell session. Install and import the ExchangeOnlineManagement module using the following cmdlets. The Install-Module cmdlet recommends upgrading the package if the module is already installed.

   Install-Module ExchangeOnlineManagement
   Import-Module ExchangeOnlineManagement
   Connect-IPPSSession

2. Use the New-ServicePrincipal cmdlet to create a service principal with your app's details and verify it by using Get-ServicePrincipal cmdlet.

   Run the following cmdlets, replacing the AppId, ObjectId, and DisplayName arguments in the first cmdlet.

   New-ServicePrincipal -AppId "0969a7fc-3e17-424f-92a4-54e583b2142a" -ObjectId "a8c1aaec-d18a-47fa-aec5-8651d755223c" -DisplayName "Graph App Auth"
   Get-ServicePrincipal

3. Add the Service Principal Object ID to the eDiscoveryManager role by using the Add-RoleGroupMember cmdlet and verify by using the Get-RoleGroupMember cmdlet.

   Run the following cmdlets, replacing the Member argument in the first cmdlet.

   Add-RoleGroupMember -Identity "eDiscoveryManager" -Member "a8c1aaec-d18a-47fa-aec5-8651d755223c"
   Get-RoleGroupMember -Identity "eDiscoveryManager"

4. Add the Service Principal Object ID to the eDiscoveryAdministrator role by using the Add-eDiscoveryCaseAdmin cmdlet and verify by using the Get-eDiscoveryCaseAdmin cmdlet.

   Run the following cmdlets, replacing the User argument in the first cmdlet.

   Add-eDiscoveryCaseAdmin -User "a8c1aaec-d18a-47fa-aec5-8651d755223c"
   Get-eDiscoveryCaseAdmin

Screenshot of the exchange online shell (image in original source)

Step 5: Connect to Microsoft Graph API using app-only access

Use the Connect-MgGraph cmdlet to authenticate and connect to Microsoft Graph using the app-only access method in PowerShell. This setup enables your app to interact with Microsoft Graph securely.

Step 6: Invoke Microsoft Graph API requests

After you're connected, you can start making calls to the Microsoft Graph API by using the Invoke-MgGraphRequest cmdlet. This cmdlet allows you to perform various operations required by eDiscovery services in your organization.

Source 14: Data sources in eDiscovery

Original URL: https://learn.microsoft.com/purview/edisc-data-sources

Accessed: 2026-09-14

Data sources in eDiscovery

In Microsoft 365, data is stored across three platforms: Exchange, Microsoft Teams, and SharePoint. These platforms organize and manage data within Microsoft 365 applications. Most Microsoft 365 apps store data in one or more of the following containers:

• Users: Data associated with individual users, such as their mail, 1:1 Teams messages, and OneDrive files.
• Groups: Data owned by the organization or a group of users within an organization. These groups are often referred to as Unified Groups or Teams.

In eDiscovery, the concept of data source streamlines the process of identifying and managing data across Microsoft 365 platforms. eDiscovery users select a user or group, which creates a data source. eDiscovery automatically identifies and organizes relevant data stored across platforms. The data source gathers locations related to the user or group (mailboxes, OneDrive sites, SharePoint sites) and adds the locations in the data source hierarchy. eDiscovery users refine the scope by selecting or excluding specific locations as needed.

A user data source typically includes:

• User mailbox
• OneDrive site

Unified groups are classified into three types, each covering specific data locations:

• Teams: Includes Exchange mailbox storage for Teams chats and emails, as well as all associated SharePoint sites for channels and the team.
• Viva Engage: Includes Exchange mailbox storage for Viva Engage messages.
• Classic: Includes only SharePoint sites.

eDiscovery users can also use organization-wide sources to perform searches across your organization. Organization-wide sources include:

• All people and groups: Includes all users and all groups in your organization.
• All public folders: Includes all content in Exchange public folders mailboxes.

Important

For large organizations, tenant-wide searches across all Exchange mailboxes and SharePoint sites are long-running processes. Service throttling can affect these searches because of the number of mailboxes and sites to search. Before running these tenant-wide searches, review scale limits and throughput guidance in Limits in eDiscovery. Plan to conduct searches in batches as applicable. To improve performance and operability, break the search into scoped runs by using compliance boundaries (for example, by region, business unit, or department) so each search targets a subset of mailboxes and sites.

It's common to search a set of user mailboxes when you manage the list as a distribution list. Adding distribution lists is supported, and the search includes only the Exchange mailboxes listed in the group.

You can search for specific data sources or data locations by using user or group's names, mailbox Simple Mail Transfer Protocol (SMTP) addresses, and OneDrive or SharePoint site URLs. When you create a search by using specific data sources, you search only the locations specified in the data source.

If you use the organization-wide source All people and groups, the search covers all Exchange mailboxes, OneDrive, and SharePoint sites. To search all Exchange mailboxes only, select mailboxes under All people and groups and deselect the sites. To search all SharePoint and OneDrive sites only, select sites under All people and groups and deselect the mailboxes.

Real-time data source sync helps ensure that you're always informed about the latest changes in data locations associated with users and groups. You can query if any specific data sources are added to a search, if a hold includes newly provisioned data locations, or if data locations are removed.

For example, if you create a private channel for a Teams group, the sync feature on the data source panel alerts you of the new location. You can quickly and easily include it in searches or holds. This sync ensures that new data doesn't go unnoticed and is included in your investigations. This sync also helps prevent potential data loss from location changes.

For more information about using data sources effectively, check out the following video:

Supported group types

The following table summarizes which group types can be added as data sources in eDiscovery, and how membership is handled for hold policies vs. searches.

Group type	Supported as data source	Hold behavior	Search behavior
Distribution list (static)	Yes	Members snapshotted at hold creation. Re-add the group to reflect membership changes.	Members re-resolved each time the search runs.
Exchange Dynamic Distribution Group (DDG)	No	Not supported as a hold data source.	Not supported as a search data source.
Mail-enabled security group	Yes	Same as distribution list.	Same as distribution list.
Microsoft 365 group	Yes	Group mailbox and associated SharePoint site snapshotted at hold creation.	Group mailbox and site re-resolved each time the search runs.
Microsoft Entra ID dynamic Microsoft 365 group	No	Same limitation as Entra dynamic security groups.	Same limitation as Entra dynamic security groups.
Microsoft Entra ID dynamic security group	No	Entra dynamic security groups (groups with a membershipRule) aren't supported.	Entra dynamic security groups aren't supported.
Microsoft Teams group	Yes	Group mailbox plus the associated SharePoint site snapshotted at hold creation. Channel sites resolved at hold creation.	Group mailbox and site re-resolved each time the search runs.
Viva Engage group	Yes	Group mailbox snapshotted at hold creation.	Group mailbox re-resolved each time the search runs.

Note

If you need a scope that tracks dynamic membership criteria, create a static mail-enabled security group, synchronize its membership from the dynamic group on a schedule (for example, by using a scheduled Microsoft Graph and Exchange Online PowerShell job), and add the static shadow group as the data source. For holds, re-add the shadow group periodically to reflect updates. For searches, membership is re-resolved at each run.

Add data sources to cases

Important

Data sources in the legacy eDiscovery experience don't synchronize to the same case in the new eDiscovery experience. You must add the data sources in the case in the new eDiscovery experience in the Microsoft Purview portal again.

After you enable premium eDiscovery features for a case, use the following options to add data sources to the case:

Tip

Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.

Bulk import data sources to a case

In an eDiscovery case, you can add multiple data sources to a case by adding a list of SMTP addresses or URLs. The import feature validates the entries before adding the sources, so you can correct any potential problems, such as typos. This streamlined process helps you save time and add many data sources to your cases more efficiently.

Before you import data sources, review the following considerations:

• You can import up to 500 data sources at a time. To minimize the processing time for searching and adding locations, split the import into multiple imports instead of importing the maximum number of data sources at one time.

• You must use the ; delimiter in your list of SMTP addresses or URLs. Your list should follow the formatting of the following example:

  abh784@contoso.ms;https://contosodemos2.sharepoint.com/sites/Logistics;https://contosodemos2.sharepoint.com/sites/Mark8Project-UETConference;https://contosodemos2.sharepoint.com/sites/WG-ProjectObsidian;maib31@contoso.ms;rma230@contoso.ms;sva561@contoso.ms;mmz776@contoso.ms;LogisticsDSIGoldenSetDataToloka1@contoso.ms;jka132@contoso.ms;shafar929@contoso.ms;ika636@contoso.ms;brobet@contoso.ms;koka81@contoso.ms;rash95@contoso.ms;mvga66@contoso.ms;mra715@contoso.ms;abe543@contoso.ms;kto888@contoso.ms;moba80@contoso.ms;mian41@contoso.ms;inch48@contoso.ms;Mario.Smith_0803@contoso.ms;yape61@contoso.ms;mwo365@contoso.ms;fasi19@contoso.ms;HumanResourcesDugoPlannerTest@contoso.ms;kamo78@contoso.ms;bga844@contoso.ms;salesteam@contoso.ms;cko475@contoso.ms;ProjectZ@contoso.ms;TalentSourcingDanieltest5@contoso.ms;las450@contoso.ms;elfl69@contoso.ms;jch952@contoso.ms;asch81@contoso.ms;gmu955@contoso.ms;okbo68@contoso.ms

• Distribution groups aren't expanded to individual members during the import process.

• To import an inactive mailbox as a data source, add a . prefix to the email address of the inactive mailbox. For example, .sarad@contoso.onmicrosoft.com.

• Unverified SMTP addresses aren't added, but unverified URLs are supported. An unverified URL means the data source can't be verified against a valid SharePoint site that is in a locked state.

To bulk import data sources to a case, complete the following steps:

1. Go to the Microsoft Purview portal and sign in by using the credentials for a user account assigned eDiscovery permissions.

2. Select the eDiscovery solution card, and then select Cases in the left navigation.

3. Select a case, and then select the Data sources tab to add data sources to the case. When you add sources to this tab, you make these data sources available to choose from in all searches and holds in the case.

4. Select Bulk import.

5. On Add data sources, enter or copy a list of SMTP addresses or URLs separated by a semicolon.

6. Select Next.

7. On Confirm data sources, view the list of data sources and the verification status.

8. After verification of the data sources finishes, unverified sources are highlighted in red and marked as Unverified for you to review.

   • To update unverified sources, select the check box next to the data source and select Edit to update the data source information. You can correct any typo, path, or format errors. After editing the selected source, select Save and the updated data sources are automatically reverified.
   • To export the list of data sources, select Export list. This action creates a .csv file that contains user inputs, matched sources, and the status of the sources.
   • Any input with multiple matches is shown with (Duplicate) in front. You can include a subset of duplicated matched sources based on your needs.
   • To remove any data sources from the import, select the data source and select Delete.

9. When you're ready to add any of the listed data sources, select the check box for each item you want to add and then select Add.

   Note

   Depending on the number of sources selected, it might take some time to process and add the data sources to the case.

Add one or more data sources to a case

1. Go to the Microsoft Purview portal and sign in by using the credentials for a user account assigned eDiscovery permissions.

2. Select the eDiscovery solution card, and then select Cases in the left navigation.

3. Select a case, and then select the Data sources tab to add data sources to the case. When you add sources to this tab, all searches and holds in the case can choose these data sources.

4. Select Add and pick choices from the following data source areas:

   Note

   When searching for sources, some sources show up with a ? in front of the source and labeled as Unverified. You can't verify these sources (sites or mailboxes) as valid sources when selected. These mailboxes or sites are external or the site is private or locked. You can add unverified sources to searches or holds and the system tries verification for these sources again when the search runs. Final search and hold results are included in the location .csv file in the process report.

   1. The left side of the pane displays the Filter options for sources.

   2. In the Scope items by section, only All sources in the tenant (default) is available. Select any data source available in your organization.

   3. Use one of the following options in the Show for filter to help scope your sources in the Search section:

      • All people and groups (default)
      • People only
      • Groups only

   4. If applicable, select Exclude inactive users to reduce the scope of sources to only currently active users in your organization.

   5. After you filter data sources, use the search control and selectors in the Search section to add specific data sources, users, and groups to the search query. Enter the specific users, groups, or organization locations you want to add in the search field and select Search. You can use ";" as delimiter to trigger multiple searches at once. For example, input john@contoso.com;david@contoso.com allows you to search and find matches to both mailboxes at once. The ; delimiter doesn't support site URLs.

      Search for people using the following values:

      • First and family name of the user display name (for example, John Smith)
      • First name only
      • User SMTP address
      • User alias
      • Exchange GUID
      • URL of the user's OneDrive site

      Search for groups using the following values:

      • Group mailbox SMTP address

      • URL of group site. The URL of a Teams channel site resolves the Teams group as a data source.

        If you add a distribution group, the list of group members isn't listed and the group is added to the search as a data source mailbox. When the search runs, the distribution group member mailboxes are expanded and fully searched.

        To confirm the mailboxes searched for the distribution group members, use the Locations_the date/time of the report information in the Process report after the search is completed. To confirm group membership before running the search, select the ellipse menu for the group and Members.

5. Select Add to add the data source to the selected case. This data source is now available when adding data sources for searches and holds in the case.

Important

You can manage individual data resources for a data source only when you add the case-level data source to an individual search and hold in the case. For example, to include or exclude mailboxes or sites in a search or hold for a data source configured at the case level, add the case-level data source to the search or hold, and then select Manage.

Add data sources to searches and holds

Add data sources to a specific search or hold by following these steps:

1. In a new search or hold, select Add sources. Or, select + and choose Add data sources from the dropdown. You can search for and select specific data sources to search or hold against.

   If you need to perform the search against organizational-wide mailboxes or sites, select Add tenant-side sources in the empty search or select the + button and choose an organizational-wide source from the dropdown.

   Note

   Organizational-wide sources are only available in searches, not holds.

2. The left side of the pane displays the Filter options for sources. Use filters to scope the data sources by:

   • All sources in the tenant (default): Use this option to search from data sources available in your organization.

   • All sources in this case: Use this option to choose from data sources added at the case level. By using this option, you can quickly use data sources added to the case in a search or hold without having to search across your entire organization.

   • Use one of the following options in the Show for filter to help scope your sources in the Search section:

     • All people and groups (default)
     • People only
     • Groups only

   • If applicable, select Exclude inactive users to reduce the scope of sources to only currently active users.

   • Use Locations to include control to specify if the selected data sources added to the search or hold include:

     • Mailboxes and sites (default): Selected people or group sources include the mailbox and site to the search or hold. This selection means selecting the user includes both the mailbox and OneDrive for the user. Selecting a Microsoft 365 group includes the group mailbox and all associated group sites.
     • Mailboxes only: Only mailbox associated with the select user or group is included. OneDrive and SharePoint sites aren't included.
     • Sites only: Only sites associated with the select user or group are included. Mailboxes aren't included.

3. After you filter the data sources, use the search control and selectors in the Search section to add specific data sources, users, and groups to the search query. Enter the specific users, groups, or organization locations you want to add in the search field and select Search. Use a semicolon as delimiter for multiple searches at once. For example, john@contoso.com;david@contoso.com searches and finds matches for both mailboxes at once. The semicolon delimiter doesn't support site URLs.

4. Select Save and close to add the data source to the current search or hold.

5. Alternatively, select Manage to fine-tune the relevant mailboxes and sites under the selected sources. The Manage view provides a detailed view of all mailboxes and sites associated with each source, displaying details such as the mailbox SMTP address and site URL. For Teams sources, it also includes the corresponding channel names and type information.

Other considerations

• In the data source picker, you might not find some users or groups. In the Manage sources view, some selected sources might not display associated sites. This problem can happen for several reasons:

  • OneDrive not provisioned, provisioning delay, or sync issues: If a user doesn't have OneDrive provisioned, their source includes only a mailbox and not a OneDrive site. The OneDrive site exists, but it isn't synced in the compliance directory due to provisioning latency.
  • Deleted or departed user: If you remove a user from the directory or soft-delete or deactivate their account, their OneDrive site might still exist but isn't linked to their user object. It doesn't appear under their source in the Manage view. For email content, consider using an inactive mailbox if the mailbox was placed on hold before deletion. For OneDrive content from a deleted user, add the OneDrive site URL directly as a SharePoint location in the search or hold.
  • Unlicensed user: The user's Microsoft 365 license was removed, which breaks the link to their OneDrive site and can deactivate their mailbox. Reassign the required license and wait for the service to provision the data source before adding it again.
  • Mailbox converted: The user’s mailbox was converted to a shared mailbox or a mail user. This change might affect how the system associates OneDrive.
  • Multiple site collection admins: If the OneDrive site has multiple admins and ownership is unclear, the system might not map it to the original user.
  • Retention or hold-only state: The user has an inactive mailbox or hold-only state, and OneDrive might be cleaned up per retention policies.
  • Unverified source: When searching for data sources, some mailboxes or sites might appear with a ? icon and the label Unverified. This status means the system couldn’t confirm the source as valid at selection time – often because the mailbox or site is external, private, or locked. You can still add unverified sources to searches or holds. Verification is attempted again when the search runs, and the final status is reflected in the location.csv file in the process report.
  • Ambiguous identity: Duplicate entries exist in the directory, such as two users with similar names or an old account with the same alias. Work with your Microsoft Entra ID or Exchange admin to identify and remove duplicate objects so each email address corresponds to a single unique mailbox.
  • Unresolved recipient: The user can't be found in the directory. For newly created accounts, allow up to 24 hours for directory synchronization to complete. Verify in the Exchange admin center that the mailbox exists and is active.

If a user shows Not available after adding, remove and re-add the user after the underlying account issue is resolved. You can verify data source availability by checking the Microsoft 365 admin center for the user's account status. To check for duplicate objects, run Get-Recipient -Filter "EmailAddresses -eq 'user@domain.com'" in Exchange Online PowerShell.

Note

When sites show as Not available, manually add the URLs to the search or hold data sources.

• When you add a distribution group, the list of group members isn't displayed. The distribution group is added to the search as a data source mailbox. When you run the search, the system expands and fully searches the distribution group member mailboxes. To confirm the mailboxes searched for the distribution group members, use the Locations_*the date/time of the report* information in the Process report after the search completes. To confirm group membership before running the search, select the ellipsis menu for the group and members.

  If the membership of the distribution group changes after adding it as a data source in the search, run the search again to include items for the current members of the group. Each time you run the search, current members are included and former members are excluded.

Inactive mailboxes

You can search, review, and export inactive mailboxes stored in your organization in eDiscovery. To hold inactive mailbox content, first apply the hold policy to the active mailbox, verify success, and then change the mailbox to inactive.

When using inactive mailboxes in eDiscovery searches and holds, consider the following points:

• Search inactive mailboxes in an eDiscovery search. For a list of the inactive mailboxes in your organization, run Get-Mailbox -InactiveMailboxOnly in Exchange Online PowerShell. Alternatively, go to Data lifecycle management > Microsoft 365 > Retention in the Microsoft Purview portal and select More (the navigation bar ellipses).

• If an existing search includes a user mailbox and you update that mailbox to inactive, the search continues to search the inactive mailbox when you rerun the search.

• Some users might have an active mailbox and an inactive mailbox that have different SMTP addresses. In this case, only the specific mailbox you select as a location for a search is searched. If you add a user's mailbox to a search, you can't assume that both active and inactive mailboxes are searched. Only the mailbox you explicitly add to the search is searched.

• Use Security & Compliance PowerShell to create a search for an inactive mailbox. You must append a period to the email address of the inactive mailbox. For example, the following command creates a content search that searches an inactive mailbox with the email address pavelb@contoso.onmicrosoft.com:

  New-ComplianceSearch -Name InactiveMailboxSearch -ExchangeLocation .pavelb@contoso.onmicrosoft.com -AllowNotFoundExchangeLocationsEnabled $true

• Avoid having an active mailbox and inactive mailbox with the same SMTP address. If you need to reuse the SMTP address assigned to an inactive mailbox, recover the inactive mailbox or restore the contents of an inactive mailbox to an active mailbox (or the archive of an active mailbox), and then delete the inactive mailbox. For more information, see the following articles:

  • Recover an inactive mailbox in Office 365
  • Restore an inactive mailbox in Office 365
  • Delete an inactive mailbox in Office 365

• Hold policies aren't supported for inactive mailboxes. You must place holds on active mailboxes before the mailbox is deleted. For more information, see Create and manage inactive mailboxes.

Data source options

After you add sources to a search or hold, you can edit the sources or explore related sources as needed. Select the ellipsis next to the source you want to edit or remove.

The following options are available in User or group options:

• Manage data source
• Include or remove a mailbox
• Include or remove sites

Explore related sources

You can explore and add related sources from existing sources in a search or hold. These options give you the ability to investigate potentially relevant sources and bring in more sources to a specific search or hold.

For users you add in the Data Sources pane, you can explore the following connections:

• Manager
• Direct reports
• Frequent collaborators
• Groups the user owns
• Groups the user is a member of

By exploring these relationships, you can quickly identify and include relevant individuals and data sources in a search scope. Use Manage to fine-tune whether to include only mailboxes, only sites, or both related sources in a search or hold.

Manager

Use this option to explore upward in the reporting chain. When you select the user's manager, you include supervisory or decision-making context in your investigation.

Direct reports

Use this option to explore downward in the organization hierarchy for the user. This option is useful when the selected user is a manager or team lead, and you want to include their team members' communications or content.

Frequent collaborators

Use this option to find other users that frequently collaborate with the selected user. Frequent collaborators are the top 10 users who are most relevant to the selected user. You can select the mailboxes and sites for these users as data sources for searches.

Groups the user owns

This option shows groups that the selected user is listed as an owner. These groups might contain shared content or communications relevant to the investigation.

Groups the user is a member of

This option includes all groups the user is a member of, even if they're not the owner. These groups might provide additional context or shared data sources.

Group members

When you add a group in the Data Sources pane, you can explore and expand the group to view its members. By using this feature, you can:

• Identify individual users within the group that might hold relevant data.
• Select specific members as additional data sources for targeted searches.

This feature helps when investigating shared content or communications originating from collaborative groups such as Microsoft 365 Groups, Teams, or distribution lists.

Note

The list of group members and groups that a user is in (or owns) is capped at 100. If a user is included in more than 100 groups, owns more than 100 groups, or if a group has more than 100 members, the portal displays only the first 100 members.

Source 15: Finding content in Microsoft Teams in eDiscovery

Original URL: https://learn.microsoft.com/purview/edisc-search-teams

Accessed: 2026-09-14

Finding content in Microsoft Teams in eDiscovery

This article provides a comprehensive set of procedures, guidelines, and best practices for using eDiscovery to preserve, collect, review, and export content from Microsoft Teams. The goal of this article is to help you optimize your eDiscovery search for Teams content.

For more information about finding content in Microsoft Teams with eDiscovery, check out the following video:

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Where Teams content is stored

To manage Teams content in eDiscovery, you need to understand the type of Teams content you can collect, process, and review in eDiscovery and where Microsoft 365 stores that content. To configure Teams content locations in a case, see Configure data sources. Teams data is stored in Azure Cosmos DB. Exchange Online stores Teams compliance records that the substrate captures, and eDiscovery can access these records. The data stored in Exchange Online is hidden from clients. eDiscovery never operates against the real Teams message data, which remains in Azure Cosmos DB.

The following table lists Teams content types and where Microsoft 365 stores each type for compliance purposes.

Teams category	Description	Chat messages/posts location	Files/attachments location	Meeting recordings location
Events	All data from webinars and town halls is stored in Cosmos DB. Substrate (SCD) serves as secondary storage for redundancy and eDiscovery purposes.	N/A	N/A	N/A
Private channels	Message posts, replies, and attachments shared in a private Teams channel.	Messages sent in a private channel are stored in the Exchange Online mailboxes of all members of the private channel.	Files shared in a private channel are stored in a dedicated SharePoint site associated with the private channel.	N/A
Shared channels	Message posts, replies, and attachments shared in a shared Teams channel.	Messages sent in a shared channel are stored in a system mailbox associated with the shared channel.^2^	Files shared in a shared channel are stored in a dedicated SharePoint site associated with the shared channel.	N/A
Teams 1:1 chats	Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations.	Messages in 1:1 chats are stored in the Exchange Online mailbox of all chat participants.	Files shared in a 1:1 chat are stored in the OneDrive account of the person who shared the file.	N/A
Teams channels	Chat messages, posts, replies, and attachments shared in a standard Teams channel.	All channel messages and posts are stored in the Exchange Online mailbox associated with the team.	Files shared in a channel are stored in the SharePoint site associated with the team.	N/A
Teams group chats	Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations.	Messages in group chats are stored in the Exchange Online mailbox of all chat participants.	Files shared in group chats are stored in the OneDrive account of the person who shared the file.	N/A
Teams meetings	Audio and transcripts from recorded Teams meetings.	Chats in recorded meetings are stored in an Exchange Online mailbox. For standard meetings, it's stored in the mailboxes of all participants. For channel meetings, it's stored in the mailbox associated with the team.	Files and attachments shared in recorded meetings are stored in the OneDrive account for the user recording the Teams meeting.	Meeting recordings are stored in the OneDrive account for the user recording the Teams meeting.^1^
Teams reactions	Reactions applied to chat messages, posts, and attachments in a Teams conversation.	Messages in group chats are stored in the Exchange Online mailbox of all chat participants.	Files shared in group chats are stored in the OneDrive account of the person who shared the file.	N/A

Note

^1^ To locate Teams meeting audio and transcript content, create an eDiscovery search targeting the organizer's OneDrive. Include the date range and file extension in the query. When the search completes, refine the results in a review set and select only the pertinent data. For example, a date range might be from March 17, 2025 to March 18, 2025 and the file extension might be mp4.

^2^ To search for (and preserve) messages sent in a shared channel, you must search or specify the Exchange Online mailbox for the parent Team.

Teams content types

All Microsoft Teams 1:1 or group chats are journaled through to the respective users' mailboxes. All standard channel messages are journaled through to the group mailbox representing the team. Files uploaded in standard channels are covered under the eDiscovery functionality for SharePoint and OneDrive.

eDiscovery of messages and files in private channels works differently than in standard channels. For more information, see eDiscovery of private channels.

Recorded Teams meetings are stored in the OneDrive account of the meeting organizer or initiator, depending on the MeetingRecordingOwnership configuration. Attendee identification information when using the Hide Attendee Names functionality for Teams meetings is stored in the user mailbox of the meeting organizer.

Not all Teams content is eDiscoverable. The following table shows the Teams content types that you can search for using Microsoft eDiscovery tools:

Content type	Notes
Audio recordings	Audio calls between Teams user and external contacts
Card content	See Search for card content for more information.
Chat links
Chat messages	This includes content in standard Teams channels, 1:1 chats, 1:N group chats, chats with yourself, and chats with guests.
Code snippets
Edited messages	If the user is on hold, previous versions of edited messages are also preserved.
Emojis, GIFs, and stickers
Inline images
Loop components	Content in a loop component is saved in a .fluid file that's stored in the OneDrive account of the user who sends the loop component. That means you have to include OneDrive as a data source when searching for content in loop components.
Meeting IM conversations
Meeting metadata^1^
Meeting recordings and transcripts	Transcripts of the meeting audio are extracted and provided as a separate file. Maximum supported recorded meeting .mp4 file size is 350 MB. If the recorded meeting file size is greater than 350 MB, a processing error occurs and the file is available for download.
Name of channel
Quotes	Quoted content is searchable. However, search results don't indicate that the content was quoted.
Reactions (such as likes, hearts, and other reactions)	Reactions are supported for all commercial customers after June 1, 2022. Reactions before this date aren't available for eDiscovery. Expanded reactions are now supported. To understand reaction history, the content must be on legal hold.
Subject
Tables
Teams Video Clip (TVC)	Search TVC with "Video-Clip" keyword and "save as" a .mp4 file for each TVC attachment by right-clicking the preview. TVCs are collected as Teams conversation attachments (if smaller than 200 MB) and separate .mp4 files. TVC file data is discoverable in eDiscovery review sets and can be exported. Preview of video clips isn't currently supported.

^1^ Meeting (and call) metadata includes the following:

• Meeting start and end time, and duration
• Meeting join and leave events for each participant
• VOIP joins/calls
• Federated user joins
• Guest joins

Important

Anonymous users joining meetings and calls aren't currently supported in eDiscovery search queries.

Microsoft Teams data appears as IM or Conversations in the Excel eDiscovery export output. You can open the .pst file in Outlook to view those messages after you export them.

When viewing the .pst file for the team, all conversations are located in the Team Chat folder under Conversation History. The title of the message contains the team name and channel name.

Private chats in a user's mailbox are stored in the Team Chat folder under Conversation History.

eDiscovery of private and shared channels

Compliance copies of messages in private and shared channels go to different mailboxes depending on the channel type. That difference means you need to search different mailbox locations based on the type of channel a user belongs to.

• Private channels: Compliance copies go to the dedicated private channel mailbox. You need to search private channel mailboxes when searching for content in private channel messages.
• Shared channels: Compliance copies go to a system mailbox that's associated with the parent team. Because Teams doesn't support an eDiscovery search of a single system mailbox for a shared channel, you need to search the mailbox for the parent team (by selecting the name of the Team mailbox) when searching for message content in shared channels.

Each private and shared channel has its own SharePoint site that's separate from the parent team site. Files in private and shared channels are stored in their own site and managed independently of the parent team. You must identify and search the specific site associated with a channel when searching for content in files and channel message attachments.

Use the following sections to help identify the private or shared channel to include in your eDiscovery search.

Identify the members of a private channel

Use the following procedure to identify members of a private channel so that you can use eDiscovery tools to search the member's mailbox for content in private channel messages.

Before you perform these steps, make sure you have the latest version of the Teams PowerShell module installed.

1. Run the following command to get the group ID of the team that contains the shared channels you want to search.

   Get-Team -DisplayName <display name of the parent team>

   Tip

   Run the Get-Team cmdlet without any parameters to display a list of all Teams in your organization. The list contains the group ID and DisplayName for every team.

2. Run the following command to get a list of private channels in the parent team. Use the group ID for the team that you obtained in step 1.

    Get-TeamChannel -GroupId <parent team GroupId> -MembershipType Private

3. Run the following command to get a list of private channel owners and members for a specific private channel.

    Get-TeamChannelUser -GroupId <parent team GroupId> -DisplayName "Partner Shared Channel"

4. Include the mailboxes of owners and members of a private channel as part of your eDiscovery search query.

Search for content for guests

You can use eDiscovery tools to search for Teams content related to guests in your organization. Teams chat content that's associated with a guest is preserved in a cloud-based storage location, and you can search for it by using eDiscovery. This content includes 1:1 and 1:N chat conversations where a guest participates with other users in your organization. You can also search for private channel messages where a guest participates and for content in guest:guest chat conversations where the only participants are guests.

To search for content for guests:

1. Connect to Microsoft Graph PowerShell. For more information, see the Microsoft Graph PowerShell overview. Be sure to complete Step 1 and Step 2 in the previous article.

2. After you successfully connect to Microsoft Graph PowerShell, run the following command to display the user principal name (UPN) for all guests in your organization. You need to use the UPN of the guest when you create the search in step 4.

   Get-MgUser -Filter "userType eq 'Guest'" -All $true | FL UserPrincipalName

   Tip

   Instead of displaying a list of user principal names on the computer screen, you can redirect the output of the command to a text file. You can do this by appending > filename.txt to the previous command. The text file with the user principal names is saved to the current folder.

3. In a different Windows PowerShell window, connect to Security & Compliance PowerShell. For instructions, see Connect to Security & Compliance PowerShell. You can connect with or without using multifactor authentication.

4. Create a search query that searches for all content (such as chat messages and email messages) where the specified guest was a participant by running the following command.

   New-ComplianceSearch <search name> -ExchangeLocation <guest UPN>  -AllowNotFoundExchangeLocationsEnabled $true -IncludeUserAppContent $true

   For example, to search for content associated with the guest Sara Davis, run the following command.

   New-ComplianceSearch "Sara Davis Guest" -ExchangeLocation "sara.davis_hotmail.com#EXT#@contoso.onmicrosoft.com" -AllowNotFoundExchangeLocationsEnabled $true -IncludeUserAppContent $true

   For more information about using PowerShell to create searches, see New-ComplianceSearch.

5. Run the following command to start the search that you created in step 4:

   Start-ComplianceSearch <search name>

6. Go to the Microsoft Purview portal and sign in by using the credentials for a user account assigned eDiscovery permissions.

7. Select the eDiscovery solution card and then select Cases in the left navigation.

8. Select a case.

9. In the list of searches on the Searches tab, select the search that you created in step 4 to display the flyout page.

10. On the flyout page, you can do the following things:

    • Select Sample to view the search results and preview the content.
    • Next to the Query field, select Edit to edit and then rerun the search. For example, you can add a search query to narrow the results.
    • Select Export to export and download the search results.

Search for card content

Apps generate card content in Teams channels, 1:1 chats, and 1xN chats. The content is stored in mailboxes and you can search it. A card is a UI container for short pieces of content. Cards can have multiple properties and attachments, and can include items that trigger card actions. For more information, see Cards.

Like other Teams content, where you store card content depends on where you used the card. The Teams group mailbox stores content for cards used in a Teams channel. The mailboxes of the chat participants store card content for 1:1 and 1xN chats.

To search for card content, use the kind:microsoftteams or itemclass:IPM.SkypeTeams.Message search conditions. When you review search results, you see that bots generate card content in a Teams channel and the Sender/Author email property is <appname>@teams.microsoft.com, where appname is the name of the app that generated the card content. If a user generates card content, the Sender/Author value identifies the user.

When you view card content in search results, the content appears as an attachment to the message. The attachment is named appname.html, where appname is the name of the app that generated the card content.

Note

To display images from card content in search results (such as the checkmarks in the previous screenshot), you need to be signed into Teams (at https://teams.microsoft.com) in a different tab in the same browser session that you use to view the search results. Otherwise, image placeholders are displayed.

Search for Teams meetings by date

Admins can search for Teams meeting content based on the meeting start or end dates. To filter review set items by specific Teams meeting dates, use the Meeting start date and Meeting end date properties in eDiscovery search tools.

Search for hidden attendees in Teams meetings

The Hide Attendee Names feature in Microsoft Teams hides the name of attendees from other attendees so only organizers can see attendees names. Use this feature for meetings or events with external businesses, vendors, confidential meetings, or other meetings where personal privacy between attendees is important. When you enable this feature, the names of attendees are hidden in the meeting roster, meeting chat, and meeting recordings.

To search for the names of attendees in Teams meetings where the Hide Attendee Names feature was enabled, you must include the organizer's mailbox in the scope for the search. Hidden attendee names are only available in the organizer's mailbox.

Search for Teams Events data

All data from webinars and town halls is stored in Cosmos DB. Substrate (SCD) serves as secondary storage for redundancy and eDiscovery purposes. For webinars created before September 2024, this data remains in the webinar organizer's SharePoint storage to ensure continuity for V1 webinars.

eDiscovery applies all event-related information, including Event titles, Descriptions, Attendee registration data, Presenters, and Themes. Event registration details, such as attendee lists and registrant email addresses, are captured in eDiscovery logs. Live attendance data isn't included.

For legal cases, use the Microsoft Purview portal to include "Microsoft Teams Virtual Events" as an external data source in the processes. After creating a case and selecting data sources, create a search query to collect relevant Teams Event data for legal and compliance needs.

For future updates, see the Message Center for feature availability and functionality.

eDiscovery in external access and guest environments

Admins can use eDiscovery to search for content in chat messages in a Teams meeting in external access and guest access environments based on the following restrictions:

• External access: In a Teams meeting with users from your organization and users from an external organization where external attendees are using external access, admins in both organizations can search for content in chat messages from the meeting.
• Guest: In a Teams meeting with users from your organization and guests, only admins in the organization who hosts the Teams meeting can search for content in chat messages from the meeting.

Search for Skype for Business conversations

You can use the following keyword query to specifically search for content in Skype for Business conversations:

kind:im

The previous search query also returns chats from Microsoft Teams. To prevent this issue, you can narrow the search results to include only Skype for Business conversations by using the following keyword query:

kind:im AND subject:conversation

The previous keyword query excludes chats in Microsoft Teams because Skype for Business conversations are saved as email messages with a Subject line that starts with the word "Conversation".

To search for Skype for Business conversations that occurred within a specific date range, use the following keyword query:

kind:im AND subject:conversation AND (received=startdate..enddate)

Source 17: Learn about case settings in eDiscovery

Original URL: https://learn.microsoft.com/purview/edisc-settings-cases

Accessed: 2026-09-14

Learn about case settings in eDiscovery

Case settings in eDiscovery let you view and update case information and take action on specific cases in eDiscovery.

The following information displays for the selected case:

• Premium features: Shows the status of premium eDiscovery features enabled in the case. To use premium eDiscovery features for the selected case, turn on the eDiscovery (Premium) toggle.

Note

Premium features are enabled by default for tenants with premium feature access. To turn off, toggle the setting after a case is created.

• License: Shows the current licensing subscription for the case. Values are eDiscovery (Premium) or eDiscovery (Standard).
• ID: Shows the case identification number. You can review this number, but you can't change it after the case is created.
• Case name: Shows the case name. This field is required. To change the case name, enter the new case name and select Actions > Save.
• Case number: Shows an optional docket number or other numeric identifier for the case. To change the case number, enter the new case number and select Actions > Save.
• Case description: Shows an optional description to help others understand this case. To change the case description, enter the new case description and select Actions > Save.
• Case status: Shows the current case status.
• Case created: Shows the date and time when the case was created.

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Close a case

When you complete the legal case or investigation supported by eDiscovery, you can close the case. Here's what happens when you close an eDiscovery case:

Note

You need to either disable or delete all active hold policies in the case before you can close the case.

• Delete any active hold policies. After you delete the hold, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This delay hold helps prevent content from being immediately deleted and gives you an opportunity to search for or recover content that is permanently deleted after the delay hold period expires.
• The case is still listed on the Cases page in the Microsoft Purview portal. The details, holds, searches, and members of a closed case are retained.
• You can edit a closed case. For example, you can add or remove members, create searches, export search results, and prepare search results for analysis in eDiscovery.

To close a case, complete the following steps:

1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
2. Select the eDiscovery solution card and then select Cases.
3. Select a case, then navigate to the Hold policies tab.
4. Delete all hold policies in the case.
5. After the hold policies are deleted, select Case settings.
6. On Case settings, select Actions, then select Close case. It might take up to 60 minutes for the closing process to complete.

When you close a case, you see the status of the case changing as the case is processed for closing.

Reopen a closed case

When you reopen an eDiscovery case, the process doesn't automatically reinstate any holds that were in place when the case was closed. After you reopen the case, go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, then set the Status toggle to On.

To reopen a closed case, complete the following steps:

1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
2. Select the eDiscovery solution card, then select Cases in the left navigation.
3. Select a case, then select Case settings.
4. On Case settings, select Actions, then select Reopen case. It might take up to 60 minutes for the reopening process to complete.

Delete a case

You can delete both active and closed eDiscovery cases. When you delete a case, you also delete all components associated with the case, such as the list of communications, searches, review sets, and exports. You can't recover or reopen a deleted case.

Note

In data spillage scenarios, the only way to remove items in a review set is to delete the eDiscovery case. Other search and purge methods don't remove items from a review set.

Before you can delete a case, you must delete all hold policies listed on the Hold policies tab of the case. This requirement includes deleting holds with a status of Off.

To delete hold policies associated with a case, complete the following steps:

1. Go the Hold policies tab in the eDiscovery case that you want to delete.
2. Select the hold policy that you want to delete.
3. On the hold policy page, select Policy actions > Delete policy.

To delete a case, complete the following steps:

1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
2. Select the eDiscovery solution card, then select Cases in the left navigation.
3. Select a case, then select Case settings.
4. On the Case settings page, select Actions, then select Delete case.

Source 36: IT Admins - Private channels in Microsoft Teams

Original URL: https://learn.microsoft.com/en-us/microsoftteams/private-channels

Accessed: 2026-09-14

IT Admins - Private channels in Microsoft Teams

Private channels in Microsoft Teams create focused spaces for collaboration within your teams. Only the users on the team who are owners or members of the private channel can access the channel. Anyone, including guests, can be added as a member of a private channel as long as they're existing members of the team.

You can use a private channel to limit collaboration to specific individuals or to facilitate communication between a group of people assigned to a specific project, without having to create another team to manage.

For example, a private channel is useful in these scenarios:

• A group of people in a team want a focused space to collaborate without having to create a separate team.
• A subset of people in a team wants a private channel to discuss projects and topics, such as budgets, resourcing, strategic positioning, and so on.

A lock icon indicates a private channel. Only members of private channels can see and participate in private channels that they're added to.

When a private channel is created, it links to the parent team and can't be moved to a different team. Additionally, private channels can't be converted to standard channels and vice versa.

Note

Private channels now support channel meetings and are no longer limited to 30 channels per team. Instead, private channels are included in the overall support limit of up to 1,000 channels per team. Currently, this excludes tenants in special cloud environments - for those tenants, the enhanced functionality comes later this year.

Compare private channels with other types of channels.

Private channel creation

By default, any team owner or team member can create a private channel. Guests can't create them. The ability to create private channels can be managed at the team level and at the organization level. Use policies to control which users in your organization are allowed to create private channels. Once you set the policies, team owners can turn off or turn on the ability for members to create private channels in the Settings tab for a team.

The person who creates a private channel is the private channel owner and only the private channel owner can directly add or remove people from it. A private channel owner can add any team member to a private channel they created, including guests. Members of a private channel have a secure conversation space, and when new members are added, they can see all conversations (even old conversations) in that private channel.

Team owners who aren't a member of a private channel can see the channel under Manage team but not in the channels and teams list. A private channel owner or team owner (whether or not they're a member of the private channel) can delete the private channel. A deleted private channel can be restored within 30 days after its deletion.

Team members can only see private channels that they're added to.

Adding and removing owners and members

A private channel owner can't be removed through the Teams client if they're the last owner of one or more private channels.

If a private channel owner leaves your organization or if they're removed from the Microsoft 365 group associated with the team, a member of the private channel is automatically promoted to be the private channel owner.

If a team member leaves or is removed from a team, that user is removed from all private channels in the team. If the user is added back to the team, they must be added back to the private channels in the team.

Note

Learn more about enhancements to private channels and streamlining of compliance management at New enhancements in Private Channels in Microsoft Teams unlock their full potential. B2B collaboration user properties are described at Understand and manage the properties of B2B guest users.

Channel owner settings

Each private channel has its own settings that the channel owner can manage, including the ability to add and remove members, add tabs, and @mentioning for the entire channel. These settings are independent of the parent team settings. When a private channel is created, it inherits settings from the parent team, after which its settings can be changed independently of the parent team settings.

The private channel owner can select Manage channel, and then use the Members and Settings tabs to add or remove members and edit settings.

Private channel owner and member actions

The following table outlines what actions owners, members, and guests can do in private channels.

Action	Team owner	Team member	Team guest	Private channel owner	Private channel member	Private channel guest
Create private channel	Admin controlled	Admin and team owner controlled	No	N/A	N/A	N/A
Delete private channel	Yes	No	No	Yes	No	No
Leave private channel	N/A	N/A	N/A	Yes unless they're the last owner	Yes	Yes
Edit private channel	No	N/A	N/A	Yes	No	No
Restore deleted private channel	Yes	No	No	Yes	No	No
Add members	No	N/A	N/A	Yes	No	No
Edit settings	No	N/A	N/A	Yes	No	No
Manage tabs and apps	No	N/A	N/A	Yes, apps must be installed for the team	Channel owner controlled	No

Private channel SharePoint sites

Each private channel has its own SharePoint site. The separate site is to ensure access to private channel files is restricted to only members of the private channel. These sites can be easily enhanced to a full-featured site through the site management interface. Each site is created in the same geographic region as the site for the parent team. These lightweight sites have a custom template ID, "TEAMCHANNEL#0" or "TEAMCHANNEL#1", for easier management through PowerShell and Graph API.

Note

Only people with owner or member permissions in the channel have access to the channel site. People in the parent team and admins don't have access unless they're also channel members. Also note, private channels have been moved to group compliance as part of an ongoing initiative. With this change, newly created private channels will not be created with a folder by default.

A private channel site syncs data classification and inherits guest access permissions from the site of the parent team. Membership to the site owner and member groups are kept in sync with the membership of the private channel within Teams. Site permissions for a private channel site can't be managed independently through SharePoint.

Teams manages the lifecycle of the private channel site. If the site is deleted outside of Teams, a background job restores the site within four hours as long as the private channel is still active.

If a private channel or a team containing a private channel is restored, the sites are restored with it. If a private channel site is restored and it's beyond the 30-day soft delete window for the private channel, the site operates as a standalone site.

Retention policies can also be used for private channel sites. For more information, see Learn about retention for SharePoint and OneDrive.

Note

When you create a new team, private channel, or shared channel in Microsoft Teams, a team site in SharePoint gets automatically created. To edit the site description or classification for this team site, go to the corresponding channel’s settings in Microsoft Teams.

Learn more about managing Microsoft Teams connected teams sites.

Compliance copies of private channel messages

Compliance copies of messages sent in a private channel are now delivered to the group mailbox (instead of mailbox of all private channel members). The titles of the compliance copies are formatted to indicate which private channel they were sent from.

For more information about performing an eDiscovery search for private channel messages, see eDiscovery of private channels.

Considerations around file access in private channels

Sharing files and folders in a private channel works the same as with other SharePoint sites. Users can share files and folders using sharable links based on the sharing settings configured by the SharePoint Administrator.

Sharing a OneNote notebook in a private channel site is the same as sharing access to any other item. If a user is granted access to a notebook in a private channel through SharePoint, removing the user from the team or private channel doesn't remove the user's access to the notebook. If an existing notebook is added as a tab to a private channel, access to the private channel isn't changed, and the notebook retains its existing permissions.

Private channel limitations

Private channels don't support connectors and tabs in Stream, Planner, Tasks by Planner and To Do, and Forms.

It isn't possible to convert a private channel to another channel type.

Notifications from private channels aren't included in missed activity emails.

Note

To check if all private channels in your tenant have been moved to the new compliance model, please refer to the PowerShell module: Get-TenantPrivateChannelMigrationStatus (MicrosoftTeams) | Microsoft Learn.

Source 38: Get-TenantPrivateChannelMigrationStatus

Original URL: https://learn.microsoft.com/en-us/powershell/module/microsoftteams/get-tenantprivatechannelmigrationstatus

Accessed: 2026-09-14

Get-TenantPrivateChannelMigrationStatus

• Module:
  • MicrosoftTeams PowerShell module

You use the Get-TenantPrivateChannelMigrationStatus cmdlet to check the status of private channel migration for your tenant.

Syntax

Default (Default)

Get-TenantPrivateChannelMigrationStatus

Description

The Get-TenantPrivateChannelMigrationStatus cmdlet allows tenant administrators to track the status of the private channel migration for their Microsoft Teams organization. More details about the migration can be found in the Microsoft Teams blog in New enhancements in Private Channels in Microsoft Teams unlock their full potentia.

Note: This cmdlet requires tenant administrator permissions to execute.

Examples

Example 1

This example gets the migration status for a tenant where all channels have been migrated.

Get-TenantPrivateChannelMigrationStatus

TenantId                     : 12345678-1234-1234-1234-123456789abc
MigrationStatus              : Completed
MigrationStartTimeStamp      : 2025-10-09T10:15:00.456Z
MigrationCompletionTimeStamp : 2025-10-09T12:45:00.789Z
Details                      : {"totalChannels":10,"migratedChannels":10,"failedChannels":0,"ownerlessChannels":0,"remainingChannels":0}

Example 2

This example gets the migration status for a tenant where some channels require admin attention.

Get-TenantPrivateChannelMigrationStatus

TenantId                     : 94d200e4-2df1-45b9-bc3e-53cfa7cf4997
MigrationStatus              : RequiresAdminAttention
MigrationStartTimeStamp      : 2026-02-10T06:48:20.000Z
MigrationCompletionTimeStamp :
Details                      : {"totalChannels":10,"migratedChannels":6,"failedChannels":1,"ownerlessChannels":2,"remainingChannels":1,"ownerlessChannelsDetails":[{"channelThreadId":"19:70c903e82053408790c3941f614a4d36@thread.tacv2","teamId":"12025f7b-4e7d-4d4c-b597-10f52de1c198"},{"channelThreadId":"19:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6@thread.tacv2","teamId":"b94ac03c-ba25-4e79-89ab-d23f707863f7"}]}

Example 3

This example parses the Details JSON and lists ownerless channels in a table.

$result = Get-TenantPrivateChannelMigrationStatus
$details = $result.Details | ConvertFrom-Json
Write-Host "Total: $($details.totalChannels), Migrated: $($details.migratedChannels), Failed: $($details.failedChannels), Ownerless: $($details.ownerlessChannels)"
if ($details.ownerlessChannelsDetails) { $details.ownerlessChannelsDetails | Format-Table channelThreadId, teamId }

Inputs

None

This cmdlet does not accept pipeline input.

Outputs

System.Object

Returns a PrivateChannelMigrationStatusResponse object with the following properties:

Property	Type	Description
TenantId	String	The Microsoft Entra tenant identifier.
MigrationStatus	String	Overall migration status for the tenant. Possible values: NotStarted, InProgress, Completed, RequiresAdminAttention.
MigrationStartTimeStamp	DateTime	When migration started for this tenant. Empty if migration has not started.
MigrationCompletionTimeStamp	DateTime	When migration completed. Only populated when all channels are done.
Details	String	JSON string containing channel counts and per-channel detail arrays.

Migration status values

Value	Description
NotStarted	No private channels have been processed for this tenant.
InProgress	Migration is underway.
Completed	All private channels have been successfully migrated.
RequiresAdminAttention	One or more channels were skipped because they have no owners. If these channels are still in use, a tenant admin or Teams service admin can add an owner to unblock migration. Failed channels do not require admin action and are retried automatically.

Details JSON fields

Field	Type	Description
totalChannels	Integer	Total number of private channels for this tenant.
migratedChannels	Integer	Number of channels migrated successfully.
failedChannels	Integer	Number of channels where migration failed. No admin action is needed.
ownerlessChannels	Integer	Number of channels skipped because they have no owners.
remainingChannels	Integer	Number of channels still in progress or not yet started.
ownerlessChannelsDetails	Array	Per-channel details for ownerless channels. Each entry contains channelThreadId and teamId.

Channel detail object

Field	Type	Description
channelThreadId	String	The unique identifier of the private channel.
teamId	String	The unique identifier (GroupId) of the parent team. This is the same value used by the -GroupId parameter in Get-Team, Get-TeamChannel, and Microsoft Graph team resource.

Notes

• This cmdlet requires tenant administrator permissions.
• Private channels remain functional throughout the migration process.
• The Details property is returned as a JSON string. Use ConvertFrom-Json to parse it.
• When no ownerless channels exist, the ownerlessChannelsDetails array may be empty or omitted from the JSON.
• Ownerless channels were skipped because they have no owners. If these channels are still in use, a tenant admin or Teams service admin can add an owner using Add-TeamUser and Add-TeamChannelUser.

Related Links

• New enhancements in Private Channels in Microsoft Teams unlock their full potential
• Microsoft Teams PowerShell Overview
• Get-Team
• Get-TeamChannel
• Add-TeamUser
• Add-TeamChannelUser

Source 47: List ediscoveryNoncustodialDataSources

Original URL: https://learn.microsoft.com/en-us/graph/api/security-ediscoverycase-list-noncustodialdatasources?view=graph-rest-1.0

Accessed: 2026-09-14

List ediscoveryNoncustodialDataSources

Namespace: microsoft.graph.security

Get a list of the non-custodial data sources and their properties.

This API is available in the following national cloud deployments.

Global service	US Government L4	US Government L5 (DOD)	China operated by 21Vianet
✅	✅	✅	❌

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type	Least privileged permissions	Higher privileged permissions
Delegated (work or school account)	eDiscovery.Read.All	eDiscovery.ReadWrite.All
Delegated (personal Microsoft account)	Not supported.	Not supported.
Application	eDiscovery.Read.All	eDiscovery.ReadWrite.All

Important

For delegated access using work or school accounts, the signed-in user must be assigned a supported Microsoft Purview role through one of the following options:

• eDiscovery Manager. Allows members to view and access eDiscovery cases they create, including searching and accessing case data. However, eDiscovery Managers can only access and manage the cases they create. This is the least privileged option for managing their own cases.
• eDiscovery Administrator. Provides all the permissions of eDiscovery Manager, plus the ability to view and access all eDiscovery cases in the organization.

Additional roles that provide read access to eDiscovery cases:

• Compliance Administrator. Includes Case Management and Compliance Search permissions.
• Organization Management. Includes Case Management and Compliance Search permissions.
• Reviewer. Provides read-only access to review sets within eDiscovery cases where the user is a member.

The eDiscovery Manager and eDiscovery Administrator roles are part of the Microsoft Purview role groups and provide access to eDiscovery features through role-based access control (RBAC).

For more information about eDiscovery permissions and roles, see Assign permissions in eDiscovery.

HTTP request

POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources

Request headers

Name	Description
Authorization	Bearer {token}. Required. Learn more about authentication and authorization.

Request body

Don't supply a request body for this method.

Response

If successful, this method returns a 200 OK response code and a collection of microsoft.graph.security.ediscoveryNoncustodialDataSource objects in the response body.

Examples

Request

Here's an example of a request.

HTTP

GET https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources?$expand=dataSource

C#

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Cases.EdiscoveryCases["{ediscoveryCase-id}"].NoncustodialDataSources.GetAsync((requestConfiguration) =>
{requestConfiguration.QueryParameters.Expand = new string []{ "dataSource" };
});

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Go

// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (  "context"  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"  graphsecurity "github.com/microsoftgraph/msgraph-sdk-go/security"  //other-imports
)

requestParameters := &graphsecurity.CasesEdiscoveryCasesItemNoncustodialDataSourcesRequestBuilderGetQueryParameters{Expand: [] string {"dataSource"},
}
configuration := &graphsecurity.CasesEdiscoveryCasesItemNoncustodialDataSourcesRequestBuilderGetRequestConfiguration{QueryParameters: requestParameters,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
noncustodialDataSources, err := graphClient.Security().Cases().EdiscoveryCases().ByEdiscoveryCaseId("ediscoveryCase-id").NoncustodialDataSources().Get(context.Background(), configuration)

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Java

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

com.microsoft.graph.models.security.EdiscoveryNoncustodialDataSourceCollectionResponse result = graphClient.security().cases().ediscoveryCases().byEdiscoveryCaseId("{ediscoveryCase-id}").noncustodialDataSources().get(requestConfiguration -> {requestConfiguration.queryParameters.expand = new String []{"dataSource"};
});

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

JavaScript

const options = {authProvider,
};

const client = Client.init(options);

let noncustodialDataSources = await client.api('/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources').expand('dataSource').get();

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

PHP

<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Security\Cases\EdiscoveryCases\Item\NoncustodialDataSources\NoncustodialDataSourcesRequestBuilderGetRequestConfiguration;

$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new NoncustodialDataSourcesRequestBuilderGetRequestConfiguration();
$queryParameters = NoncustodialDataSourcesRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->expand = ["dataSource"];
$requestConfiguration->queryParameters = $queryParameters;

$result = $graphServiceClient->security()->cases()->ediscoveryCases()->byEdiscoveryCaseId('ediscoveryCase-id')->noncustodialDataSources()->get($requestConfiguration)->wait();

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

PowerShell

Import-Module Microsoft.Graph.Security

Get-MgSecurityCaseEdiscoveryCaseNoncustodialDataSource -EdiscoveryCaseId $ediscoveryCaseId -ExpandProperty "dataSource" 

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Python

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.security.cases.ediscovery_cases.item.noncustodial_data_sources.noncustodial_data_sources_request_builder import NoncustodialDataSourcesRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = NoncustodialDataSourcesRequestBuilder.NoncustodialDataSourcesRequestBuilderGetQueryParameters(	expand = ["dataSource"],
)

request_configuration = RequestConfiguration(
query_parameters = query_params,
)

result = await graph_client.security.cases.ediscovery_cases.by_ediscovery_case_id('ediscoveryCase-id').noncustodial_data_sources.get(request_configuration = request_configuration)

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

---

Response

Here's an example of the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources(dataSource())",
    "@odata.count": 3,
    "value": [
        {
            "status": "active",
            "holdStatus": "applied",
            "createdDateTime": "2022-05-23T02:09:11.1395287Z",
            "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
            "releasedDateTime": "0001-01-01T00:00:00Z",
            "id": "35393639323133394345384344303043",
            "displayName": "U.S. Sales",
            "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('35393639323133394345384344303043')/dataSource/$entity",
            "dataSource": {
                "@odata.type": "#microsoft.graph.security.siteSource",
                "@odata.id": "https://graph.microsoft.com/v1.0/sites/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
                "displayName": "U.S. Sales",
                "createdDateTime": "2022-05-23T02:09:11.1395535Z",
                "holdStatus": "0",
                "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
                "createdBy": {
                    "application": null,
                    "user": {
                        "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
                        "displayName": null
                    }
                },
                "site": {
                    "webUrl": "https://m365x809305.sharepoint.com/sites/USSales",
                    "id": "169718e3-a8df-449d-bef4-ee09fe1ddc5d",
                    "createdDateTime": "2022-05-23T02:09:11.1395535Z"
                }
            }
        },
        {
            "status": "active",
            "holdStatus": "applied",
            "createdDateTime": "2022-05-23T02:09:11.1395287Z",
            "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
            "releasedDateTime": "0001-01-01T00:00:00Z",
            "id": "31453237353743363432414242344641",
            "displayName": "Sales and Marketing",
            "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('31453237353743363432414242344641')/dataSource/$entity",
            "dataSource": {
                "@odata.type": "#microsoft.graph.security.siteSource",
                "@odata.id": "https://graph.microsoft.com/v1.0/sites/74f6c798-fc32-4dbe-9e5b-8e11459b9f44",
                "displayName": "Sales and Marketing",
                "createdDateTime": "2022-05-23T02:09:11.1397925Z",
                "holdStatus": "0",
                "id": "74f6c798-fc32-4dbe-9e5b-8e11459b9f44",
                "createdBy": {
                    "application": null,
                    "user": {
                        "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
                        "displayName": null
                    }
                },
                "site": {
                    "webUrl": "https://m365x809305.sharepoint.com/sites/SalesAndMarketing",
                    "id": "74f6c798-fc32-4dbe-9e5b-8e11459b9f44",
                    "createdDateTime": "2022-05-23T02:09:11.1397925Z"
                }
            }
        },
        {
            "status": "active",
            "holdStatus": "applied",
            "createdDateTime": "2022-05-23T02:09:11.1395287Z",
            "lastModifiedDateTime": "2022-05-23T02:09:11.1395287Z",
            "releasedDateTime": "0001-01-01T00:00:00Z",
            "id": "46333131344239353834433430454335",
            "displayName": "Retail",
            "dataSource@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/noncustodialDataSources('46333131344239353834433430454335')/dataSource/$entity",
            "dataSource": {
                "@odata.type": "#microsoft.graph.security.siteSource",
                "@odata.id": "https://graph.microsoft.com/v1.0/sites/dbe4b18e-2765-4989-8647-48139180c45f",
                "displayName": "Retail",
                "createdDateTime": "2022-05-23T02:09:11.1399861Z",
                "holdStatus": "0",
                "id": "dbe4b18e-2765-4989-8647-48139180c45f",
                "createdBy": {
                    "application": null,
                    "user": {
                        "id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
                        "displayName": null
                    }
                },
                "site": {
                    "webUrl": "https://m365x809305.sharepoint.com/sites/Retail",
                    "id": "dbe4b18e-2765-4989-8647-48139180c45f",
                    "createdDateTime": "2022-05-23T02:09:11.1399861Z"
                }
            }
        }
    ]
}

Source 49: ediscoveryCaseSettings resource type

Original URL: https://learn.microsoft.com/en-us/graph/api/resources/security-ediscoverycasesettings?view=graph-rest-1.0

Accessed: 2026-09-14

ediscoveryCaseSettings resource type

Namespace: microsoft.graph.security

Contains settings for an eDiscovery case. For details, see Configure search and analytics settings in eDiscovery (Premium).

Inherits from entity.

Methods

Method	Return type	Description
Get settings	microsoft.graph.security.ediscoveryCaseSettings	Read the properties and relationships of an ediscoveryCaseSettings object.
Update settings	microsoft.graph.security.ediscoveryCaseSettings	Update the properties of an ediscoveryCaseSettings object.
Reset settings to default	None	Reset all settings to the default values.

Properties

Property	Type	Description
caseType	microsoft.graph.security.caseType	The type of the eDiscovery case. The possible values are: standard, premium, unknownFutureValue.
id	String	The ID of the eDiscovery case. Inherited from entity.
ocr	microsoft.graph.security.ocrSettings	The OCR (Optical Character Recognition) settings for the case.
redundancyDetection	microsoft.graph.security.redundancyDetectionSettings	The redundancy (near duplicate and email threading) detection settings for the case.
reviewSetSettings	microsoft.graph.security.reviewSetSettings	The settings of the review set for the case. The possible values are: none, disableGrouping, unknownFutureValue.
topicModeling	microsoft.graph.security.topicModelingSettings	The Topic Modeling (Themes) settings for the case.

caseType values

Member	Description
standard	Standard eDiscovery case for E3 tenants.
premium	Premium eDiscovery case with advanced features for E5 tenants.
unknownFutureValue	Evolvable enumeration sentinel value. Don't use.

reviewSetSettings values

Member	Description
none	No other options selected.
disableGrouping	Disable the grouping control.
unknownFutureValue	Evolvable enumeration sentinel value. Don't use.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.ediscoveryCaseSettings",
  "caseType": "String",
  "id": "String (identifier)",
  "ocr": {"@odata.type": "microsoft.graph.security.ocrSettings"},
  "redundancyDetection": {"@odata.type": "microsoft.graph.security.redundancyDetectionSettings"},
  "reviewSetSettings": "String",
  "topicModeling": {"@odata.type": "microsoft.graph.security.topicModelingSettings"}
}

---

Published by Muse · 2026-10-01.