• "Book - Microsoft Dynamics CRM 2011 - Customization & Configuration - (MB2-866) Certification Guide - Chap. 3 - Pages 41-43"
  Published by Neil Benson (Packt Publishing)
  http://www.packtpub.com/sites/default/files/9781849685801_Chapter_03.pdf

Depending on the number of users in your deployment, user management can be an occasional task for the CRM system administrator or a continuous workload for the CRM system administration team.

There are several reasons why user management is important:

• Maintaining users in the correct business unit and with the correct security roles ensures that they have access only to the privileges and records that they are entitled to according to your security policies.
• Maintaining the access modes and license types for your users and purchasing the appropriate client access license ensures that your organization complies with its Microsoft license agreements.
• Maintaining correct manager for each user ensures that any escalations will work correctly. For example, you might have a workflow rule that notifies a user’s manager when one of the user’s cases or opportunities meet certain criteria.
• Maintaining teams correctly can simplify the task of assigning security roles to specific users and supports the sharing of records between users.
• Reports are often based on business units and/or teams. If users are not assigned to the correct business units or teams, management reports will be incorrect.

In order to log in CRM, a user must have a user account in the CRM organization and must be authenticated by an authentication service.

Different authentication services are used depending upon the type of deployment.

In a typical on-premise deployment, when the user opens the Microsoft Dynamics CRM web client or Microsoft Dynamics CRM for Outlook, the user’s network login credentials will be automatically passed to Active Directory for authentication. This is known as a single sign-on.

Different access modes and license type depending on the type of deployment are available.

The access modes available within on-premise deployment are as follows:

• Read-Write: This is the typical access mode assigned to most users. Users with the read-write access type can work with all records according to their security privileges.
• Administrative: This access mode provides users with access only to the Settings area and it does not consume a license.
• Read: Users with this access mode can read the records according to their security privileges, but cannot create, update, or delete any records.

Full or limited client access licenses need to be purchased for all users with a read-write access mode. Limited client access licenses need to be purchased for all users with a read access mode.

The client access license (CAL) types available within an on-premise deployment are as follows:

• Full: This is the license type is assigned to most users. Users with the full license type can create, read, update, and delete all records according to their security privileges.
• Limited: This license type allows users to work with a subset of entities.
• Device Full: Devices with the device-full license type can be shared by users to work with all records according to their security privileges.
• Device Limited: Devices with the device-limited license type can be shared by users to work with a subset of records.
• Employee Self-Service: This license type provides limited read and write access to entities through a custom user interface that accesses the CRM API.

For an on-premise deployment, client access licenses are required for each named user. Microsoft considers all employees and people acting like an employee to be users, and they each need their own CAL.

Client access licenses are not required for people who are not employees and who access the CRM features and data through a custom user interface such as a customer, partner, or supplier portal. Instead, an external connector license for each CRM server in the deployment is required.

• Disabled users cannot log in to CRM.
• Disabled users do not consume a client access license.
• Records cannot be assigned to a disabled user.
• Published processes (workflows or dialogs) owned by a disabled user will not work until the workflows are reassigned to an active user or the disabled user is re-enabled.

• Enabled users consume a client access license.
• Enabling a disabled user does not affect the user’s security roles.

• You cannot assign a user to any of the default business unit teams.
• A user assigned to a team will be granted all the security privileges associated with any security roles assigned to the team.