Read-only accounts are accounts that cannot be modified by users even though they have valid credentials. The read-only accounts can be used to login at services but neither their passwords or other data can be changed. The read-only accounts are mostly used for technical accounts.
Read-only accounts can only be modified again if the read-only status is removed and the account become writeable again. Administrators of the edu-ID support team may also convert regular edu-ID accounts from real users to read-only accounts in special situations (e.g. to protect the account from further modifications in case of security incidents).
Read-only accounts are identified by the eduPersonEntitlement attribute value: