Is there an easy way to create a read-only role?

No need to make it on field level - make it on function level - click on All and set None for Edit/Delete/MassUpdate per each module
Like this:

Ok, that's a big help, thank you.

With 70 modules in our instance, that's still a lot of clicking, but it's a whole lot better than doing it at the field level.

Thanks again.

Brent Billock unfortunately there is no easy answer for you here.

I will be shooting in the dark a little, trying to give you some hints.

One relatively technical workaround would be to leverage a community tool we built called SystemData. That was built 4+ years ago, and I am not even sure it still works today, but you could give it a try. The tool can be found on this public git repository of SugarCRMLabs github.com/.../SystemData

The aim of the tool at the time was to export/import system information across instances.

The way you could use it is to extract the role information (which will give you a json export file). On the json file you could quickly change the permissions needed and re-import it.

I realise this is more of an admin/developer tool, but it could help you get where you want to be faster, plus it could help you version/keep a backup of your roles definition.

The way I would use it is on a sandbox first. Then after you verify that it installs fine, and that the export/import of manually modified roles works on a sandbox all as expected, you could proceed further.

If you do try it, let us know how that goes!

Brent Billock unfortunately there is no easy answer for you here.

I will be shooting in the dark a little, trying to give you some hints.

One relatively technical workaround would be to leverage a community tool we built called SystemData. That was built 4+ years ago, and I am not even sure it still works today, but you could give it a try. The tool can be found on this public git repository of SugarCRMLabs github.com/.../SystemData

The aim of the tool at the time was to export/import system information across instances.

The way you could use it is to extract the role information (which will give you a json export file). On the json file you could quickly change the permissions needed and re-import it.

I realise this is more of an admin/developer tool, but it could help you get where you want to be faster, plus it could help you version/keep a backup of your roles definition.

The way I would use it is on a sandbox first. Then after you verify that it installs fine, and that the export/import of manually modified roles works on a sandbox all as expected, you could proceed further.

If you do try it, let us know how that goes!