diff --git a/src/com/android/settings/vpn2/VpnSettings.java b/src/com/android/settings/vpn2/VpnSettings.java
index cd24be882bf..4cbb3df3b53 100644
--- a/src/com/android/settings/vpn2/VpnSettings.java
+++ b/src/com/android/settings/vpn2/VpnSettings.java
@@ -223,6 +223,8 @@ public class VpnSettings extends SettingsPreferenceFragment implements
         final List<LegacyVpnInfo> connectedLegacyVpns = getConnectedLegacyVpns();
         final List<AppVpnInfo> connectedAppVpns = getConnectedAppVpns();
 
+        final Set<Integer> readOnlyUsers = getReadOnlyUserProfiles();
+
         // Refresh the PreferenceGroup which lists VPNs
         getActivity().runOnUiThread(new Runnable() {
             @Override
@@ -233,11 +235,13 @@ public class VpnSettings extends SettingsPreferenceFragment implements
                 for (VpnProfile profile : vpnProfiles) {
                     ConfigPreference p = findOrCreatePreference(profile);
                     p.setState(ConfigPreference.STATE_NONE);
+                    p.setEnabled(!readOnlyUsers.contains(UserHandle.myUserId()));
                     updates.add(p);
                 }
                 for (AppVpnInfo app : vpnApps) {
                     AppPreference p = findOrCreatePreference(app);
                     p.setState(AppPreference.STATE_DISCONNECTED);
+                    p.setEnabled(!readOnlyUsers.contains(app.userId));
                     updates.add(p);
                 }
 
@@ -417,6 +421,19 @@ public class VpnSettings extends SettingsPreferenceFragment implements
         return connections;
     }
 
+    @WorkerThread
+    private Set<Integer> getReadOnlyUserProfiles() {
+        Set<Integer> result = new ArraySet<>();
+        for (UserHandle profile : mUserManager.getUserProfiles()) {
+            final int profileId = profile.getIdentifier();
+            if (mUserManager.hasUserRestriction(UserManager.DISALLOW_CONFIG_VPN, profile)
+                    || mConnectivityManager.getAlwaysOnVpnPackageForUser(profileId) != null) {
+                result.add(profileId);
+            }
+        }
+        return result;
+    }
+
     static List<AppVpnInfo> getVpnApps(Context context, boolean includeProfiles) {
         List<AppVpnInfo> result = Lists.newArrayList();