I have been a part of over 10 upgrade or fresh installs of MSCRM 4.0 and every so often I get a complaint from the client that they cannot promote items from Outlook to CRM because they are told they do not have sufficient privileges to do so. After checking the security role everything looks good but still they cannot promote. I have even modified the role such that it has full access to EVERYTHING and still users with that role cannot promote. However, the system administrator can promote. So, the next step I tried was to create a copy of the system administrator role and have it replace the non-working role. The users who have the copy of the role as thier role, with no privileges modified, can now promote items from Outlook to CRM. I then tried removing the privileges such that they macthed the original role. Now the users could promote with not problem. All privileges were the same the last time through, so what was the difference? The only difference was that the second role was a copy of the System Administrator role.
I guess this means that there is some hidden attribute or something that CRM checks for that none of the other roles have (maybe the system customizer role).
The good news is that I haven't seen this issue with new installs of CRM 4.0, only in upgrades from 3.0 to 4.0. And in all honesty I've seen this issue in probably 20-30% of the upgrades I've been a part of. Not a ton but enough to cause a headache if you don't know the answer.
Good luck out there!
Dynamic Methods Inc.