Impersonation is one user(User A)'s executing code to perform some tasks on behalf of another user(User B). When impersonating in MS CRM, web service is called with the credentials of User A, and User B's userid is defined as the caller Id. The key point is, in the scenario above, User A must be a member of PrivUserGroup.
If User A is not added to PrivUserGroup, you will have soap exception with detail "The user does not hold the necessary privileges." when you are trying to impersonate.
