Is there an easy way to create a readonly group?
I only want users in this group to read only, but be able to see things in all tenants (i.e. all domains).
As @pbxgeek suggest: Go to Advanced -> Group Manager and add a new group and choose Permissions.
Here you need to add the permissions you want and save and reload.
In your case for the read only purpose I believe you are helped by searching for "view".
After this you need to assign this group to the intended users. Accounts -> Users -> User -> Groups
Since this new created group don't have any permissions for the menus you will also need to assign this. Advanced -> Menu Manager
Either you just add the new group to the existing menu or you create a new one.
If you choose an existing menu you might want to protect the changes.
If you create a new menu you simply press Add and save it then run Restore Defaults to receive the menu items you then edit/customize for the intended purpose.
