The excerpt below along with what I saw the guide describing the license functionality doesn't imply the need to manage functionality with a security role. With that said, on a test system I created a user and selected the "Limited" License Type, Access
Mode "Read-Write" and assigned the CEO security role. I created a custom entity and assigned the CEO role full permissions on it. I created records with a different user both custom and stock and with my test "limited" user I was still able to delete them
(security role allowed this). Looking further into the guide, the "limited" access is not supposed to be able mail merge or create workflows but I still was able to do so.
I'd be curious to see if someone else could validate this.
Taken from:
Microsoft Dynamics CRM 2011Licensing & Pricing Guide
Limited CAL - The Limited CAL provides a user with full read-only access (e.g., for reports) and limited write access to “Microsoft Dynamics CRM functionality”. Users may view or query CRM data.
The use rights supported for Limited CAL include:
- Data privileges to create Accounts, Contacts, Cases, Leads, and Activities using Microsoft Dynamics CRM clients.
- Data privileges to append, append to, and update Accounts, Contacts, Cases, Leads, and Activities created by any CRM user using Microsoft Dynamics CRM clients.
- Data privileges to assign, share, and delete Accounts, Contacts, Cases, Leads, and Activities created by the same user using Microsoft Dynamics CRM clients.
- Data privileges to follow and post activity feeds against Accounts, Contacts, Leads, Opportunities, and standard entity records created by any CRM user using Microsoft Dynamics CRM clients.
- Data privileges to create custom entity records using API access only.
- Data privileges to update custom entity records created by any CRM user using API access only.
- Append data privileges using Microsoft Dynamics CRM clients for custom activity records created by any CRM user.
- Append data privileges using API access only for custom entity records (excluding custom activity records) created by any CRM user.
- Append to data privileges using Microsoft Dynamics CRM clients for custom entity records created by any CRM user.
- Data privileges to assign, share, and delete custom entity records created by the same user using API access only.
- Data privileges to follow and post activity feeds against custom entity records using API access only.
- No data privileges to assign, share, or delete records created by other CRM users.
- Read-only access to “Microsoft Dynamics CRM functionality”.
Jason Lattimer
