Is there an easy way to create a read-only role?

No need to make it on field level - make it on function level - click on All and set None for Edit/Delete/MassUpdate per each module
Like this:

Ok, that's a big help, thank you.

With 70 modules in our instance, that's still a lot of clicking, but it's a whole lot better than doing it at the field level.

Thanks again.

Ok, that's a big help, thank you.

With 70 modules in our instance, that's still a lot of clicking, but it's a whole lot better than doing it at the field level.

Thanks again.

I sympathize @billockb there is no easy way to set them all read-only, it would be nice to be  able to do that. Perhaps you could suggest that. There used to be an "Ideas" section in the old Sugar Community Alex Nassi is there something similar in SugarClub?

If you are On Site, you could probably find a way to set these at the database level by digging into the acl_* tables, but it might get tricky if not downright messy.

You might also want to see if you can leverage some of Enrico Simonetti's work here:
enricosimonetti.com/.../

Brent Billock unfortunately there is no easy answer for you here.

I will be shooting in the dark a little, trying to give you some hints.

One relatively technical workaround would be to leverage a community tool we built called SystemData. That was built 4+ years ago, and I am not even sure it still works today, but you could give it a try. The tool can be found on this public git repository of SugarCRMLabs github.com/.../SystemData

The aim of the tool at the time was to export/import system information across instances.

The way you could use it is to extract the role information (which will give you a json export file). On the json file you could quickly change the permissions needed and re-import it.

I realise this is more of an admin/developer tool, but it could help you get where you want to be faster, plus it could help you version/keep a backup of your roles definition.

The way I would use it is on a sandbox first. Then after you verify that it installs fine, and that the export/import of manually modified roles works on a sandbox all as expected, you could proceed further.

If you do try it, let us know how that goes!