In Microsoft Dynamics CRM 2013, to use CRM for Tablets, the user’s security role must have the “CRM for Tablets” permission, but there is also another new permission needed to use the tablet apps. On the Customization tab of CRM security roles, there is a new privilege called “Application Metadata.” The user requires read access to application metadata to connect to CRM in CRM for Tablets. For new deployments, the standard roles will have this permission; however, if you are upgrading from CRM 2011 and you use custom roles, your users will not automatically get this permission. You must edit their roles and grant this permission.
There are two privileges required: users need read permission on System Application Metadata and read and write permission on User Application Metadata.