咨询：创建Dynamics CRM只读角色时，最佳OOTB基础安全角色是哪个？

Hey there! Based on your goal of setting up a universal read-only base role for all users and building extended permission roles on top of it, here's my practical recommendation:

Top Pick for Standard Scenarios: Read Only User #

This is the most reliable OOTB (out-of-the-box) role to use as your foundation:

• It’s pre-configured with read access to all core business entities (Accounts, Contacts, Opportunities, etc.) plus basic system features like views and reports—no need to build basic permissions from scratch.
• It follows the principle of least privilege but covers all common business read-only needs, so users won’t hit unexpected "access denied" errors for standard day-to-day operations.
• It’s designed by Microsoft as the official starting point for read-only user access, so it’s fully aligned with platform best practices.

Most Permissive OOTB Read-Only Role: Read-Only Access #

If you need a read-only role that covers nearly every entity (including many backend/config entities), Read-Only Access is the broadest OOTB option. It grants read access to almost all system entities, making it ideal if you want a wide-reaching read-only base that includes even niche or less-used entities.

Pro Tips for Your Implementation #

• When copying an OOTB role, keep its core permissions intact first, then tweak based on your business needs—for example, revoke read access to sensitive entities or add read permissions for custom entities you’ve built.
• Use role inheritance for your extended roles: let your edit/create-enabled roles inherit from this base read-only role. This way, users assigned both roles will get combined permissions, and you avoid reconfiguring basic read access for every extended role.
• Always test the permission setup in a sandbox environment first to confirm it behaves as expected before rolling out to production.

内容的提问来源于stack exchange，提问作者KCodeR