AzureFeeds

As of December 1^st, 2025, the Microsoft Purview eDiscovery Graph API Standard hit General Availability (GA). It provides a programmatic way to manage eDiscovery cases, searches, holds, and exports for organizations that have only M365 E3 licenses. It extends automation capabilities that were previously exclusive to eDiscovery Premium customers with M365 E5 (or equivalent add-on SKU) licenses.

With the eDiscovery Graph APIs, organisations can realise efficiency savings by automating the following elements of their eDiscovery workflow:

• Case management – create new cases, list or get case details, update cases, and close or reopen cases.


• Hold management – place content locations on hold (or remove holds) within a case and list hold policies.


• Search management – create new searches, list existing searches, update search parameters, delete searches, and run a statistics job on a search.


• View progress of eDiscovery jobs – view lists of all jobs run in the case, including their status and run times.


• Export operations – trigger an export job from a search, generate an export report, and download the export packages programmatically.


• Execute Search and Purge operations –  ability to purge email messages from mailboxes identified in a modern UX search.

For existing customers utilizing the legacy eDiscovery PowerShell cmdlets it presents an opportunity to enrich and enhance any existing automation.

eDiscovery Investigators, and teams supporting them, can benefit from the Microsoft Graph-based PowerShell cmdlets to also realize efficiency savings without implementing full end-to-end automation.

Why use Graph APIs instead of eDiscovery PowerShell cmdlets?

Moving from the old Exchange/Compliance PowerShell cmdlets to Graph API might seem like a significant change. However, there are clear benefits and improvements that make Graph API the better choice for automation. Below we compare legacy eDiscovery scripting methods (PowerShell-based) with the new Graph API approach.

What do I need to do to start using the APIs?

For customers with only E3 licenses in their tenant, before you can start using the APIs you must enable Microsoft Purview pay-as-you-go features as per the following article:

Enable Microsoft Purview pay-as-you-go features via subscription | Microsoft Learn

Before you can make any calls to the Microsoft Purview APIs for eDiscovery, you must first register an app in the Microsoft Identity Platform, Entra ID.

An application can access data in two ways:

• App-only access: An app acting with its own identity.


• Delegated access: An app acting on behalf of a signed-in user.

You should decide, based on your organizational needs, which is the appropriate model.

For unattended scripts and automation scenarios with no direct user interaction then app-only access would be the equivalent model with the APIs.

When using app-only access:

• You can work with all cases within Microsoft Purview eDiscovery


• Has the equivalent permissions to the eDiscovery Administrator role

For step-by-step guidance on how to set up app-only access to the APIs see the following articles.

Set up app-only access for Microsoft Purview eDiscovery by using Microsoft Graph APIs – Microsoft Graph | Microsoft Learn

Use Microsoft Purview APIs for eDiscovery | Microsoft Learn

If today, your eDiscovery Investigators are connecting to Security & Compliance PowerShell using the Exchange Online PowerShell module and are authenticating as themselves then Delegated access would be the equivalent model with the APIs.

Investigators using the Microsoft Graph PowerShell module eDiscovery cmdlets:

• Can only work with cases they have created or have been granted access to


• Limits their actions based on the eDiscovery Purview roles assigned to them

To enable investigators to authenticate and use the eDiscovery cmdlets from the Microsoft Graph API PowerShell module; the Microsoft Graph Command Line Tools enterprise app must be added to Entra ID and the appropriate Graph API permissions consented to.

There are two eDiscovery related Microsoft Graph Permissions and organizations should select the appropriate permissions based on their requirements. They are as follows:

• eDiscovery.Read.All: Allows the app to read eDiscovery objects such as cases, searches, holds and other related objects (link)


• eDiscovery.ReadWrite.All: Allows the app to read and write eDiscovery objects such as cases, searches, holds and other related objects (link)

You can check if these permissions are already granted to the Microsoft Graph Command Line Tools by searching for and reviewing the enterprise app in Microsoft Entra.

If they have not been granted then an administrator with either the Application Administrator, Cloud Application Administrator or Privileged Role Administrator Entra roles assign can use the following steps to grant the permissions and provide admin consent for all users in the tenant.

As delegate permissions are being used in this scenario, even though the consent applies to all users. The signed in user must also be assigned the relevant eDiscovery Purview Roles to make use of the APIs.

1. Install the Microsoft Graph PowerShell Module (link)


2. Connect to Microsoft Graph using the following PowerShell cmdlet

3. On the permissions screen select “Consent on behalf of your organization” and select accept

Now that this has been configured, eDiscovery Investigators will require the Microsoft Graph PowerShell module to connect and make use of the Microsoft Graph PowerShell modules eDiscovery cmdlets.

Frequently asked questions

Where can I find details on what APIs are available and what they can do?

Documentation for the Microsoft Purview eDiscovery Graph APIs can be found here:

Use the Microsoft Purview eDiscovery API in Microsoft Graph – Microsoft Graph v1.0 | Microsoft Learn

The documentation provides information on what the API call does, what properties are supported and examples of the request and responses.

Is there costs associated with using the Microsoft Purview eDiscovery Graph API Standard?

Currently, usage of all APIs except the Export API does not contribute towards billing.

ediscoverySearch: exportResult – Microsoft Graph v1.0 | Microsoft Learn

Usage of the Export API is billed based on the volume of data exported. Each organization receives an included amount of free storage per month (50GB), with additional usage billed at a set price per GB ($10). More information can be found here:

Billing in eDiscovery | Microsoft Learn

What happens if I have a mix of E3 and E5 licenses?

When triggering an export using the Export API for a Microsoft Purview eDiscovery case with the premium features enabled, no costs will be incurred.

When triggering an export using the Export API for a Microsoft Purview eDiscovery case with the premium features disabled, it will contribute towards billing.

Can I still use PowerShell to work with eDiscovery Cases?

Yes, you can use PowerShell cmdlets to work with Microsoft Purview eDiscovery via the APIs. Within the Microsoft Graph PowerShell module there are eDiscovery cmdlets available. When reviewing the API documentation the appropriate PowerShell cmdlets are listed within the examples section.

Take, for instance, creating a new case, when reviewing the documentation (link), we can see the New-MgSecurityCaseEdiscoveryCase is available.

Can I integrate the APIs into a custom-developed application?

Yes, you can install the Microsoft Graph SDK and it is available for the following languages:

• .NET


• Go


• Java


• JavaScript


• PHP


• PowerShell


• Python

More information on installing the Microsoft Graph SDK can be found here:

Install a Microsoft Graph SDK – Microsoft Graph | Microsoft Learn

Do third-party applications integrate with the Microsoft Purview eDiscovery APIs?

Please check with your third-party vendor for their support for the Microsoft Purview eDiscovery APIs.

Is this available in GCC, GCC High, and DoD tenants?

Yes, it is available across these environments.

Is there any scenario-based guidance for me with examples on how to use the Graph API?

There will be soon! We will be releasing further scenario-based guidance to help both Microsoft 365 E3 and E5 organizations adopt and benefit from the Microsoft Purview eDiscovery Graph APIs.