Yes, you read it correctly, if you go with default CRM configuration for Email token you might land up in a big soup... and the more delay you do to fix the issue, it will cause you more pain to fix the issue thereafter. This article is having below sections: Understanding of Token structure Understanding of Issue Security breach scenario Possible solutions Section 1: Understanding of Token Structure: As per Microsoft documentation ( Link here ), below is the Token structure As can be seen above out of 7 digits, the first digit is a deployment tracking number, second is to identify the user, and third is the actual counter having the count related to the number of emails sent Below are definitions from Microsoft, referred from the same article above Deployment base tracking number Configurable from 0-2,147,483,647. Default value is 0. Can be used as an identifier for a specific instance, organization, or deployment of Microsoft Dynamics 365. User number digit rang...