Read Only Profile Conversion to Custom Profile

When will this change happen?

The Read Only standard profile will be converted to a custom profile in existing orgs with the rollout of the Summer '21 release. We recommend that you use this transition time to review the permissions included in this profile and make changes as required.

As part of this change, Essentials editions can create up to two custom profiles and Professional editions can create up to three custom profiles. The converted custom Read Only profile counts towards this limit.

New Salesforce orgs created in Spring '21 and later don't have the Read Only profile. For new orgs who want to create a Read Only profile, we recommend that you start with the Minimum Access standard profile as a least-privilege profile base, and assign custom permission sets to grant this user the Read access required by your business needs.

How does this change impact my org?

The Read Only standard profile is converted to a custom profile that your Salesforce admins can modify. The value of the fullName field of the profile in the Metadata API is changed from "ReadOnly" to "Read Only".

Your org can be impacted in these scenarios.

Metadata retrieve() or deploy() calls on the Profile Metadata type that reference "ReadOnly" are invalid. For example, a retrieve() call with the below .xml file returns no result.

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
<types>
<members>ReadOnly</members>
<name>Profile</name>
</types>
<version>50.0</version>
</Package>

The Read Only custom profile name isn't localized. Queries of Profile.Name will always return in English, regardless of the language of the user who issues the query.
Some Apex tests that rely on the Read Only standard profile to validate negative access conditions don't work as before, especially for packaging use. Like all other custom profiles, the converted Read Only custom profile doesn't preserve consistent access rights in different orgs.

What do I need to do?

The "Convert the Read Only Standard Profile to a Custom Profile" release update is available in Spring '21. Review this release update for step-by-step instructions and recommendations on actions to take before and after the profile is converted. We have also summarized the actions to take here.

Before the profile is converted

We recommend that you first review the permissions included in the Read Only profile in the "What permissions are included in the Read Only Profile?" section. Evaluate whether the users currently assigned to the Read Only profile should continue to have the included permissions.

If you want to change the permissions granted to users assigned the Read Only profile, we recommend that you reassign users to the Minimum Access standard profile, which is a least-privilege access base. Then grant more permissions as required via permission sets or permission set groups.

To reassign users with the Read Only profile to the Minimum Access profile:

From Setup, in the Quick Find box, enter Profiles.
Select Profiles.
Navigate to the Read Only profile.
Click Assigned Users in the enhanced profile user interface or View Users in the original profile user interface.
For each user, update the profile assignment to the Minimum Access - Salesforce profile.
To grant more permissions, you can create a new permission set from scratch. Or you can create a permission set based on the Read Only profile by using the Converter feature in the Salesforce Labs Profile and Permission Set Helper app.

If you continue to use Salesforce's Read Only profile with the currently assigned users, verify that your org's custom code still works before the rollout of the Summer '21 release. Make sure that you've reviewed the changes in the "How does this change impact my org?" section. Verify that your org's custom code that references the Read Only standard profile in the impacted scenarios is updated, so that your configurations and deployments remain intact when the Read Only profile is converted.

We recommend that you update your Apex tests that rely on the Read Only profile. Use the Minimum Access Profile and additional permission sets instead for testing the user context.

After the profile is converted

After the Read Only standard profile is converted to a custom profile, you can remove or add permissions as your business needs require. You can also change the Read Only profile name. For example, the name can reflect that some permissions grant edit access or who its assignees are. If you change the profile's name, to prevent errors or disrupted functionality, review all Apex code and customizations that reference the Read Only profile. Update all references with the profile's new name.

We recommend that you test all changes to the profile in a sandbox or Developer Edition org before enabling it in your production org.

Edit Permissions in the Read Only Custom Profile After It Is Converted

Enhanced Profile User Interface

From Setup, in the Quick Find box, enter Profiles.
Select Profiles.
Navigate to and click on the "Read Only" profile.
Click on "System Permissions" or "App Permissions." Or, search for the permission you want to add or remove in the search box.
Click Edit.
Edit the permissions.
Click Save.

Original Profile Interface

From Setup, in the Quick Find box, enter Profiles.
Select Profiles.
For the "Read Only" profile, click Edit.
Edit the permissions.
Click Save.

Rename the Read Only Custom Profile After It Is Converted

Enhanced Profile User Interface

From Setup, in the Quick Find box, enter Profiles.
Select Profiles.
Navigate to and click on the "Read Only" profile.
Click Edit Properties.
Update the Name of the profile.
Click Save.

Original Profile Interface

From Setup, in the Quick Find box, enter Profiles.
Select Profiles.
For the "Read Only" profile, click Edit.
Update the Name of the profile.
Click Save.

Resources

What permissions are included in the Read Only profile?

See this table for a list of included user permissions and their descriptions:

Permission	Description	Category in Enhanced User Interface	Category in Original Profile Interface	Provides implicit or explicit edit access?
Access Activities	Access tasks, events, calendar, and email and activity-based features, such as Einstein Activity Capture and Activity Metrics.	System Permissions	General User Permissions
Access Libraries	Access libraries.	System Permissions	Administrative Permissions
Allow Access to Customized Actions	Unsupported. Use the page layout editor to customize which actions show up in Salesforce and in the Salesforce mobile app.	System Permissions	General User Permissions
Allow View Knowledge	Allow user to view knowledge articles.	App Permissions	General User Permissions
Apex REST Services	Allow access to Apex REST services.	System Permissions	Administrative Permissions	✓
API Enabled	Access any Salesforce.com API.	System Permissions	Administrative Permissions
Assign Topics	Assign existing topics to feed items. Remove topics from feed items.	System Permissions	General User Permissions	✓
Chatter Internal User	Use all Chatter features. See Chatter Overview in the Salesforce Help for more information.	System Permissions	Administrative Permissions	✓
Create and Customize List Views	Create list views; modify and delete own list views.	System Permissions	Administrative Permissions	✓
Create and Customize Reports	Create, edit, and delete reports in personal folders.	System Permissions	Administrative Permissions	✓
Create and Own New Chatter Groups	Create and own new Chatter groups.	System Permissions	Administrative Permissions	✓
Create Public Links	Let users create links to share files externally. Unlike content deliveries, public links can't be password protected. To let a user create links to files in a library, enable Deliver Content for that user in the library.	System Permissions	Administrative Permissions	✓
Create Topics	Create new topics by assigning them to feed items.	System Permissions	General User Permissions	✓
Edit My Own Posts	Allow users to edit their own feed items.	System Permissions	Administrative Permissions	✓
Edit Opportunity Product Sales Price	Change the sales price on opportunity line items.	App Permissions	General User Permissions	✓
Edit Topics	Edit topic names and descriptions.	System Permissions	General User Permissions	✓
Export Reports	Use Export Details and Printable View to export reports.	System Permissions	General User Permissions
Field Service Standard	Give users access to all standard Field Service Lightning features.	System Permissions	Administrative Permissions
Invite Customers to Chatter	Invite Customers to Chatter.	System Permissions	Administrative Permissions	✓
Knowledge One	Replaces the Articles tab with the Knowledge tab.	App Permissions	General User Permissions
Lightning Console User	Gives the user access to Lightning console apps.	System Permissions	Administrative Permissions
Lightning Experience User	Access Lightning Experience and switch between Lightning Experience and Salesforce Classic.	System Permissions	Administrative Permissions
Lightning Login	Determines if a user is eligible to use Lightning Login functionalities.	System Permissions	Administrative Permissions
Manage Macros Users Can't Undo	Create, update, and run macros that include irreversible instructions.	App Permissions	Administrative Permissions	✓
Read D&B Company records	Read D&B company records.	App Permissions	General User Permissions
Run Reports	Run reports and dashboards.	System Permissions	General User Permissions
Select Files from Salesforce	Selecting a Salesforce file is an option when attaching a file.	System Permissions	Administrative Permissions
Send Outbound Messages	Send outbound messages to an external Web service API.	System Permissions	Administrative Permissions
Send Through Gmail	When you enable this feature, some of your Salesforce org's data may be saved or processed by a third party, who may offer different privacy and security protections for such data. Salesforce.com is not responsible for the privacy and security of the data that is shared with third parties as a result of your decision to enable this feature. Allow users to send emails through Gmail when composing emails in Lightning Experience. The Send Email through External Email Services user permission is enabled by default on standard profiles.	System Permissions	Administrative Permissions	✓
Share Files with People in Communities	Share files in communities by changing their sharing settings or posting them to profiles.	System Permissions	Administrative Permissions	✓
Show App Launcher in Communities	Display the App Launcher icon in communities.	System Permissions	Administrative Permissions
Show Company Name as Community Role	Allow users to see other users' company name in community role.	System Permissions	Administrative Permissions
Subscribe to Reports	Subscribe to reports in Lightning Experience to schedule report refreshes and send notifications by email. Your organization's data may be saved and/or processed by third-party services, and Salesforce is not responsible for data users choose to send outside of Salesforce.	System Permissions	Administrative Permissions
View Help Link	Allow user to view help link.	System Permissions	Administrative Permissions
View Knowledge	View Salesforce Knowledge articles.	App Permissions	General User Permissions
View Roles and Role Hierarchy	Allow user to view roles and role hierarchy.	System Permissions	Administrative Permissions
View Setup and Configuration	View the App Setup and Administrative Settings pages.	System Permissions	Administrative Permissions
View Topics	View topics on posts, comments, and records.	System Permissions	Administrative Permissions