I've discovered a bug.



For a custom entity a user only has Read access to that entity. The security permissions are applied correctly in the web client (i.e. They can't create new records, delete etc).

In outlook 2007 with the outlook plugin (and rollup 3), the user is able to right click in the outlook plugin and create a new record. It fails on save, but the user should never even have that option shown to them.

This has been reproduced.

See details on the CRM forums and verification of the bug: http://social.microsoft.com/Forums/en-US/crm/thread/e13ff56f-566f-4c71-98a0-154150b7a63b/