diff --git a/core/lib/Drupal/Core/Config/ConfigInstaller.php b/core/lib/Drupal/Core/Config/ConfigInstaller.php
index 242d92097e..e10baa0076 100644
--- a/core/lib/Drupal/Core/Config/ConfigInstaller.php
+++ b/core/lib/Drupal/Core/Config/ConfigInstaller.php
@@ -124,12 +124,9 @@ public function installDefaultConfig($type, $name) {
       $collection_info = $this->configManager->getConfigCollectionInfo();
       foreach ($collection_info->getCollectionNames() as $collection) {
         $config_to_create = $this->getConfigToCreate($storage, $collection, $prefix, $profile_storages);
-        // If we're installing a profile ensure configuration that is overriding
-        // is excluded.
-        if ($name == $this->drupalGetProfile()) {
-          $existing_configuration = $this->getActiveStorages($collection)->listAll();
-          $config_to_create = array_diff_key($config_to_create, array_flip($existing_configuration));
-        }
+        // @todo If we're installing a profile we could exclude simple
+        //   configuration that already exists because it will have been
+        //   overridden already. Do we need to do that work?
         if (!empty($config_to_create)) {
           $this->createConfiguration($collection, $config_to_create);
         }
@@ -258,7 +255,24 @@ protected function getConfigToCreate(StorageInterface $storage, $collection, $pr
       if ($profile_storage->getCollectionName() != $collection) {
         $profile_storage = $profile_storage->createCollection($collection);
       }
-      $data = $profile_storage->readMultiple(array_keys($data)) + $data;
+      $profile_overrides = $profile_storage->readMultiple(array_keys($data));
+      if ($this->drupalInstallationAttempted()) {
+        // During installation profile provided configuration overrides can have
+        // dependencies that can not possibly be installed. Therefore, only
+        // override simple configuration. As this method is called before
+        // modules are installed the only way to determine if they are
+        // configuration entities is the presence of a dependencies key.
+        foreach ($profile_overrides as $name => $override_data) {
+          if (!isset($override_data['dependencies'])) {
+            $data[$name] = $override_data;
+          }
+        }
+      }
+      else {
+        // Allow install profiles to override configuration when installing
+        // extension after Drupal installation.
+        $data = $profile_overrides + $data;
+      }
     }
     return $data;
   }
diff --git a/core/modules/config/src/Tests/ConfigInstallProfileUnmetDependenciesTest.php b/core/modules/config/src/Tests/ConfigInstallProfileUnmetDependenciesTest.php
index 6683580eab..0fe0bf4818 100644
--- a/core/modules/config/src/Tests/ConfigInstallProfileUnmetDependenciesTest.php
+++ b/core/modules/config/src/Tests/ConfigInstallProfileUnmetDependenciesTest.php
@@ -44,11 +44,10 @@ protected function setUp() {
       }
     }
 
-    // Add a dependency that can not be met because User is installed before
-    // Action.
+    // Add a dependency that can not be met.
     $config_file = $dest . DIRECTORY_SEPARATOR . InstallStorage::CONFIG_INSTALL_DIRECTORY . DIRECTORY_SEPARATOR . 'system.action.user_block_user_action.yml';
     $action = Yaml::decode(file_get_contents($config_file));
-    $action['dependencies']['module'][] = 'action';
+    $action['dependencies']['module'][] = 'does_not_exist';
     file_put_contents($config_file, Yaml::encode($action));
 
     parent::setUp();
@@ -90,7 +89,7 @@ public function testInstalled() {
     else {
       $this->fail('Expected Drupal\Core\Config\UnmetDependenciesException exception thrown');
     }
-    $this->assertErrorLogged('Configuration objects provided by <em class="placeholder">user</em> have unmet dependencies: <em class="placeholder">system.action.user_block_user_action (action)</em>');
+    $this->assertErrorLogged('Configuration objects provided by <em class="placeholder">testing_config_overrides</em> have unmet dependencies: <em class="placeholder">system.action.user_block_user_action (does_not_exist)</em>');
   }
 
 }
diff --git a/core/modules/config/tests/src/Functional/ConfigInstallProfileOverrideTest.php b/core/modules/config/tests/src/Functional/ConfigInstallProfileOverrideTest.php
index 1f5232c939..fe478e9fbf 100644
--- a/core/modules/config/tests/src/Functional/ConfigInstallProfileOverrideTest.php
+++ b/core/modules/config/tests/src/Functional/ConfigInstallProfileOverrideTest.php
@@ -8,6 +8,7 @@
 use Drupal\Core\Config\FileStorage;
 use Drupal\system\Entity\Action;
 use Drupal\tour\Entity\Tour;
+use Drupal\user\Entity\Role;
 
 /**
  * Tests installation and removal of configuration objects in install, disable
@@ -109,6 +110,10 @@ public function testInstallProfileConfigOverwrite() {
     $this->rebuildContainer();
     $this->assertEqual($config_test_storage->load('override_unmet')->label(), 'Override', 'The optional config_test entity is overridden by the profile optional configuration and is installed when its dependencies are met.');
     $this->assertEqual($config_test_storage->load('completely_new')->label(), 'Completely new optional configuration', 'The optional config_test entity is provided by the profile optional configuration and is installed when its dependencies are met.');
+
+    // Ensure the authenticated role has the access tour permission.
+    $role = Role::load(Role::AUTHENTICATED_ID);
+    $this->assertTrue($role->hasPermission('access tour'), 'The Authenticated role has the "access tour" permission.');
   }
 
 }
diff --git a/core/profiles/testing_config_overrides/config/install/user.role.authenticated.yml b/core/profiles/testing_config_overrides/config/install/user.role.authenticated.yml
new file mode 100644
index 0000000000..1b210736be
--- /dev/null
+++ b/core/profiles/testing_config_overrides/config/install/user.role.authenticated.yml
@@ -0,0 +1,11 @@
+langcode: en
+status: true
+dependencies:
+  module:
+    - tour
+id: authenticated
+label: 'Authenticated user'
+weight: 1
+is_admin: false
+permissions:
+  - 'access tour'