Hiya,
I have also come across this and contacted Cisco TAC - they advised a workaround using the "Security Approver" role, please be advised though that this unfortunately also allows the user to commit a change (hence the Approver part).
I found that RO access to Devices/Policy and Objects + monitoring could be achieved through the following;
- Add user to Security Analyst
- Create additional RO User role and also assign this to the user
On the new RO User role select as per the attached.
I tried editing things, such as adding a firewall to an existing device group and got blocked - so seems to work well.
Hope that helps.
