Skip to content

Issue with MgSecurityCaseEdiscoveryCaseMember #3616

Closed

Description

@SWeppler-WA

Describe the bug

I am trying to add eDiscovery case members and I now get the following error message

New-MgSecurityCaseEdiscoveryCaseMember generates
Status: 401 (Unauthorized)
ErrorCode: UnknownError

Expected behavior

No error - it was working fine prior to 5/4/2026

How to reproduce

  1. Connect-MgGraph -Scopes "eDiscovery.ReadWrite.All" -TenantId '{Tenant-id}'
  2. $Case = Get-MgSecurityCaseEdiscoveryCase -EdiscoveryCaseId '{ediscoveryCase-id}'
  3. New-MgSecurityCaseEdiscoveryCaseMember -EdiscoveryCaseId $case.Id -RecipientType user -SmtpAddress '{eMail-id}'

SDK Version

2.35.1, 2.36.1, 2.37.0

Latest version known to work for scenario above?

It appears there was a change/regression prior to release of SDK 2.37.0, and the SDK did not get updated.

Known Workarounds

Use the Purview portal

Debug output

Click to expand log ```
DEBUG: [CmdletBeginProcessing]: - New-MgSecurityCaseEdiscoveryCaseMember begin processing with parameterSet 'CreateExpanded'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [AccessReview.Read.All, Agreement.Read.All, Application.Read.All, Application.ReadWrite.All, Application-RemoteDesktopConfig.ReadWrite.All, AppRoleAssignment.ReadWrite.All, AuditLog.Read.All, BitlockerKey.Read.All, Calendars.Read, Calendars.Read.Shared, Calendars.ReadWrite.Shared, Channel.ReadBasic.All, Contacts.Read, CustomSecAttributeDefinition.Read.All, DelegatedPermissionGrant.Read.All, DelegatedPermissionGrant.ReadWrite.All, Device.Read.All, Device.ReadWrite.All, DeviceLocalCredential.Read.All, DeviceManagementApps.Read.All, DeviceManagementApps.ReadWrite.All, DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, DeviceManagementServiceConfig.ReadWrite.All, Directory.AccessAsUser.All, Directory.Read.All, Directory.ReadWrite.All, Domain.Read.All, Domain.ReadWrite.All, eDiscovery.Read.All, eDiscovery.ReadWrite.All, EntitlementManagement.Read.All, Files.Read.All, Files.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, GroupMember.ReadWrite.All, IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, Mail.Send, OnPremDirectorySynchronization.Read.All, openid, Organization.Read.All, PeopleSettings.Read.All, PeopleSettings.ReadWrite.All, Policy.Read.All, Policy.Read.ConditionalAccess, Policy.Read.DeviceConfiguration, Policy.Read.PermissionGrant, profile, RecordsManagement.Read.All, RoleAssignmentSchedule.Read.Directory, RoleManagement.Read.All, RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory, SecurityEvents.Read.All, ServiceHealth.Read.All, ServiceMessage.Read.All, SharePointTenantSettings.Read.All, Sites.Read.All, Sites.ReadWrite.All, Tasks.Read, Team.ReadBasic.All, User.Invite.All, User.Read, User.Read.All, User.ReadBasic.All, User.ReadWrite, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All, WindowsUpdates.Read.All, email].

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/1854cbc0-5e87-4633-9e09-4d490220aa19/caseMembers

Headers:
FeatureFlag                   : 00000003
Cache-Control                 : no-store, no-cache
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.22631; en-US),PowerShell/7.5.1
Accept-Encoding               : gzip,deflate,br
SdkVersion                    : graph-powershell/2.37.0,
client-request-id             : 7bbb4112-1e22-427d-b369-5b300a8b1564

Body:
{
  "recipientType": "user",
  "smtpAddress": "bfal461@ecy.wa.gov"
}


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Unauthorized

Headers:
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : ddd70330-f558-4c42-92b1-fff956a39b73
client-request-id             : 7bbb4112-1e22-427d-b369-5b300a8b1564
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"West US 2","Slice":"E","Ring":"4","ScaleUnit":"001","RoleInstance":"MW2PEPF00012D00"}}
Date                          : Fri, 15 May 2026 17:12:39 GMT

Body:
{
  "error": {
    "code": "UnknownError",
    "message": "",
    "innerError": {
      "date": "2026-05-15T17:12:39",
      "request-id": "ddd70330-f558-4c42-92b1-fff956a39b73",
      "client-request-id": "7bbb4112-1e22-427d-b369-5b300a8b1564"
    }
  }
}


New-MgSecurityCaseEdiscoveryCaseMember_CreateExpanded:

Status: 401 (Unauthorized)
ErrorCode: UnknownError
Date: 2026-05-15T17:12:39

Headers:
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : ddd70330-f558-4c42-92b1-fff956a39b73
client-request-id             : 7bbb4112-1e22-427d-b369-5b300a8b1564
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"West US 2","Slice":"E","Ring":"4","ScaleUnit":"001","RoleInstance":"MW2PEPF00012D00"}}
Date                          : Fri, 15 May 2026 17:12:39 GMT


  Recommendation: See service error codes: https://learn.microsoft.com/graph/errors
DEBUG: [CmdletEndProcessing]: - New-MgSecurityCaseEdiscoveryCaseMember end processing.

</details>


### Configuration

PSVersion                      7.5.1
PSEdition                      Core
GitCommitId                    7.5.1
OS                             Microsoft Windows 10.0.22631
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

### Other information

_No response_

Activity

  1. SWeppler-WA commented on May 15, 2026

    @SWeppler-WA
    Author

    I have confirmed that an eDiscovery Administrator is able to run the New-MgSecurityCaseEdiscoveryCaseMember command successfully. I am an eDiscovery Manager. I am able to make the change in the portal. eDiscovery Managers should be able to make case member changes.

  2. ramsessanchez commented on May 18, 2026

    @ramsessanchez
    Contributor

    Hi SWeppler-WA it looks like you received an 'unauthorized' error, which you have stated shouldn't be happening since you are able to use the portal. Could you please do the following:

    1. Try making the request using graph explorer, this will help us rule out permissions issues.
    2. Try making the request you mentioned above using the following pattern:
    $params = @{
    	recipientType = "user"
    	smtpAddress = "user@microsoft.com"
    }
    
    New-MgSecurityCaseEdiscoveryCaseMember -EdiscoveryCaseId $ediscoveryCaseId -BodyParameter $params
    
  3. SWeppler-WA commented on May 18, 2026

    @SWeppler-WA
    Author

    Thank you, first time user of Graph Explorer. I have signed in and have requested Consent for eDiscovery.ReadWrite.All. State of Washington has an approval process so this will take some time.

  4. ramsessanchez commented on May 18, 2026

    @ramsessanchez
    Contributor

    SWeppler-WA sounds good, leave another comment on this thread once checked. Thanks!

  5. SWeppler-WA commented on May 29, 2026

    @SWeppler-WA
    Author

    I received consent for eDiscovery.ReadWrite.All using Graph Explorer. It appears that eDiscovery commands show up as part of the Compliance module (deprecated). Please advise on how to implement New-MgSecurityCaseEdiscoveryCaseMember using Graph Explorer.

    Image
  6. ramsessanchez commented on Jun 9, 2026

    @ramsessanchez
    Contributor

    Hi, unfortunately I am not well versed in this endpoint as we only use the endpoints that are available to generate sdk and tools. I would use the documentation available here. From the looks of it, it should be caseMembers at the end of your request.
    https://learn.microsoft.com/en-us/graph/api/security-ediscoverycasemember-list?view=graph-rest-1.0&tabs=powershell

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions