A: In order to apply the RO restriction to an Organization level, the respective Role is not allowed to have the Access all Org checkbox selected. Otherwise, this checkbox grants full rights to access organizations regardless of whether Read Only is selected at a more detailed level.
A: At Role level, you need to assign the Tenant value to the principal Preference Level ( Preference Level = Tenant) on the main screen. Afterwards, you need to reset the application so as to allow the changes to be applied.