Hi there,

This is something we recently identified (and was confirmed by MS Support) as a design limitation in Dynamics CRM. Most of the firm these days have their users also present as a Contact record in Dynamics which means that both of them share same email address. The business use case scenario would be to send out internal marketing emails.

Now when an email is exchanged between internal employees (also present as contacts), the email activity is shown under the Timeline/Social Pane of the contact record - which is public and can be viewed by everyone in the firm. At times, there will be some Confidential emails being sent which should not be exposed to entire firm and this breaches the security policy.

Note that user level activities are protected by their security role privs for activities.

Dynamics should be smart enough to NOT tag emails exchanged between users on their contact record.