Short answer
Yes. You can ask for read-only access. On Sophos this is through Sophos Central. On Fortinet it is a read-only profile in your own FortiManager ADOM. Write access to the live firewall is the exception. It needs clear approval, because it changes how the managed service is run.
In detail: Managed firewall configuration and log visibility
What you can see:
- Sophos: FirstNet walks you through Sophos Central at handover, and gives read-only access where agreed
- Fortinet: each client or business unit has its own ADOM in FortiManager, and we can give you a read-only admin profile
- Logs: Sophos Standard Protection keeps seven days of logs with basic reports. Xstream adds 30 days of cloud reports. FortiAnalyzer as a Service gives Fortinet log analysis and compliance reports
- Reports: a summary and change record each month, plus FortiManager reports on policy changes and firmware versions
Read-only access gives your team and your auditors proof, without the risk of changes no one tracked. Changes still go through FirstNet's approved process, so each one is logged and can be undone.
If your team wants to share hands-on admin, raise it when you sign. Then we can agree who does what before go-live.
Source: FirstNet Hosted Firewall & Network Security service page →