Microsoft Dynamics CRM Online Help

Create or edit a security role

Can I do this task?

Before editing a security role, you should understand data access. More information: Controlling Data Access

The recommended way to create a new security role is to copy an existing security role and modify it. More information: Select the Copy a security role option.

  1. In the Navigation Pane, click Settings, click Administration, and then click Security Roles.
  2. To edit a security role, double-click it.

    - OR -

    To create a new security role, on the Actions toolbar, click New, and on the the Common tab, type the name of the security role.


  3. Set the privileges on each tab.

    To change the access level for a privilege, click the symbol until you see the symbol you want. The possible access levels depend on whether the record type is organization-owned or user-owned.


  4. Click Save or Save and Close.


These privileges are viewable, but are for internal use only and should never be modified:

Application File, Business Unit Map, Client Update, Commitment, Competitor Address, Dependency Mode, Indexed Article, E-Mail Hash, E-Mail Search, Filter Template, Import Data, Integration Status, Internal Address, Inter Process Lock, Notification, Organization Statistic, Organization UI, Owner, principalattributeaccessmap, principleobjectaccess, Privilege Object Type Code, Resource Expansion, Ribbon Command, Ribbon Context Group, Ribbon Difference, Ribbon Rule, Ribbon Tab to Command Mapping, Role Template, Sales Process Instance, Sdk Message Pair, Sdk Message Request Field, Sdk Message Response, Sdk Message Response Field, Status Map, String Map, Subscription, Subscription Clients, Subscription Synchronization Information, Tracking information for deleted entities, SystemUser BusinessUnit Entity Map, System User Principal, Unresolved Address, UserEntityInstanceData, User Entity UI Strings, User Fiscal Calendar, Web Wizard, Web Wizard Access Privilege, Wizard Page, and Workflow Wait Subscription.

Modifying these privileges in any way can cause unexpected and undesirable behaviors in the application. More information: Microsoft Dynamics CRM Online 2011 Entities, Security Role and Privilege Reference, and Microsoft Dynamics CRM Online Security Model.


  • If you need to back up your security role changes, or export security roles for use in a different implementation of Microsoft Dynamics CRM Online, you can export them as part of exporting customizations. More information: Export Customizations and Configurations
  • It's helpful to keep in mind the minimum privileges you need to define for some common tasks. These include:
    • When logging in to Microsoft Dynamics CRM Online:
      1. To render the home page: prvReadWebResource, prvReadCustomization
      2. To render an entity grid (that is, to view lists of records and other data): Read privilege on the entity, prvReadUserSettings, prvReadQuery
      3. To view single entities in detail: Read privilege on the entity, prvReadSystemForm, prvCreateUserEntityUISettings, prvReadUserEntityUISettings
    • When logging in to Microsoft Dynamics CRM Online for Outlook:
      1. To render navigation for Microsoft Dynamics CRM Online and all Microsoft Dynamics CRM Online buttons: prvReadEntity, prvReadQuery
      2. To render an entity grid: Read privilege on the entity, prvReadCustomization, prvReadWebResource, prvReadUserQuery
      3. To render entities: Read privilege on the entity, prvReadSystemForm, prvCreateUserEntityUISettings, prvReadUserEntityUISettings, prvWriteUserEntityUISettings

Related Topics

Controlling Data Access

Manage Administration Settings

View Your User Profile

Work with Security Roles

User Summary Report

© 2012 Microsoft Corporation. All rights reserved.