What is CAL ?

• When we create user in Office 365, we usually are not allowed to make changes to users in CRM, we can just Manage Roles
  Reassign Records
  Manage Teams
  Change Business unit
  Change Manager and positions
  Manage Queue

• But there is one more option in users record
  CAL information – Client Access Level Information

So what is this CAL and how it will impact user account? Why this configuration is at user level?
CAL – Client Access Level , is nothing but an user access level.
CAL has three option in its option set
Read-Write –

This is default option selected.
This defines the user will access the system based on its security role configuration.

The user will see the system as define in security role.

There is no Restriction define here.

This user has read-write access, unless it is blocked at security role.

Administrator –
This is admin based role, who deals with adding users, managing user accounts like assigning role, creating  and managing business unit, creating and managing Owner team and access, creating and managing security roles and field security profiles.

Even this users security role has access to all entities in the system, CAL as administrator will block this user to access the system like other users and it will just expose the security section in site map setting area.

Security Role for User with CAL is as follow

and all he can see is just security area

Note : User must have System administrator or System customizer or equivalent security role.

Non interactive –

This is a user who is not interactive with CRM directly,
Directly interacting with CRM includes though CRM GUI, CRM outlook, CRM mobile client etc.

When you make user with the Access level, This user will not allowed to login to CRM from CRM GUI or any of its UI platform,

This user is Specially meant for SDK access,
Business may need some third party organization to develops tools but without accessing CRM from GUI.

This user still holds security roles, if this user don’t have access to create account entity, he will not be able to create account from SDK as well.

Security Roles implies on SDK too.

Additional options
Delegated Admin – This user is also an admin, have same option as administrator, but here system customizer or system administrator don’t want to handle user management task, so he create an user and make him a delegated admin and now this delegated admin will take care of user management.
Read – Security role base access to entities but even if the users security role has create, write, delete, append or append to access, this user will not be able to do any of this above task, as its client access is just read only
Support User – This user is created by Support team of Microsoft.

This user is for testing purpose of the quires raised by CRM clients or business users.

To view or to create a simple custom view to see the CAL user:

1. Go to Advance find.
2. Make sure Users is selected in Look for.
3. Choose Access mode and specify type of CAL
4. Click Result , Before that save this view with some familiar name.