Read Only Profile Conversion to Custom Profile

This article walks through when the change happens, how it impacts your org, and what steps to take before and after conversion.

When Will This Change Happen?

The Read Only standard profile is converted to a custom profile in existing orgs with the rollout of the Summer '21 release. Use the transition period to review the permissions included in this profile and make any required changes.
As part of this change, Essentials editions can create up to two custom profiles and Professional editions can create up to three custom profiles. The converted custom Read Only profile counts toward this limit.
New Salesforce orgs created in Spring '21 and later do not have the Read Only profile. For new orgs that want to create a Read Only profile, start with the Minimum Access standard profile as a least-privilege profile base, and assign custom permission sets to grant Read access as needed.

How Does This Change Impact My Org?

The Read Only standard profile is converted to a custom profile that your Salesforce admins can modify. The value of the fullName field of the profile in the Metadata API changes from "ReadOnly" to "Read Only" (with a space).
Your org can be impacted in these scenarios:

• Metadata retrieve() or deploy() calls on the Profile Metadata type that reference "ReadOnly" (without a space) are invalid after conversion. For example, a retrieve() call with <members>ReadOnly</members> returns no result — you must update to <members>Read Only</members>.
• The Read Only custom profile name isn't localized. Queries of Profile.Name always return in English, regardless of the user's language.
• Some Apex tests that rely on the Read Only standard profile to validate negative access conditions may not work as before, especially for packaging use.

What Do I Need to Do?

Before the profile is converted:
Review the permissions included in the Read Only profile (see the permissions table below). Evaluate whether users assigned to the Read Only profile should continue to have the included permissions.
To reassign users with the Read Only profile to the Minimum Access profile:

1. From Setup, enter Profiles in the Quick Find box.
2. Select Profiles.
3. Navigate to the Read Only profile.
4. Click Assigned Users (enhanced UI) or View Users (original UI).
5. For each user, update the profile assignment to the Minimum Access - Salesforce profile.
6. To grant more permissions, create a new permission set, or use the Converter feature in the Salesforce Labs Profile and Permission Set Helper app.

After the profile is converted:
After conversion, you can remove or add permissions as needed. If you change the profile's name, review all Apex code and customizations that reference the Read Only profile and update all references with the new name. Test all changes in a sandbox or Developer Edition org before enabling in production.
Edit Permissions — Enhanced Profile User Interface:

1. From Setup, enter Profiles in the Quick Find box.
2. Select Profiles.
3. Navigate to and click "Read Only."
4. Click "System Permissions" or "App Permissions," or search for the permission.
5. Click Edit.
6. Edit the permissions.
7. Click Save.

Edit Permissions — Original Profile Interface:

1. From Setup, enter Profiles in the Quick Find box.
2. Select Profiles.
3. For "Read Only," click Edit.
4. Edit the permissions.
5. Click Save.

Rename the Read Only Profile — Enhanced Profile User Interface:

1. From Setup, enter Profiles in the Quick Find box.
2. Select Profiles.
3. Navigate to and click "Read Only."
4. Click Edit Properties.
5. Update the Name of the profile.
6. Click Save.

Rename the Read Only Profile — Original Profile Interface:

1. From Setup, enter Profiles in the Quick Find box.
2. Select Profiles.
3. For "Read Only," click Edit.
4. Update the Name of the profile.
5. Click Save.

What Permissions Are Included in the Read Only Profile?

The following table lists user permissions included in the Read Only profile and whether each provides implicit or explicit edit access. Note: "Yes" in the last column indicates the permission provides some form of edit access despite the "Read Only" profile name.

What permissions are included in the Read Only profile?

See this table for a list of included user permissions and their descriptions: