Given that users can appear in the Enabled Users view of CRM after being allocated a license which includes the Common Data Service component (e.g. the Microsoft Flow Free license) it is technically possible for security roles to be assigned to these accounts. This can result in users having access to records in CRM despite not having a D365 license. Even though this situation can be avoided with proper management of licenses and security roles, it would be beneficial if the CRM interface prevented security roles from be assigned to users without a valid D365 license.