Like @yeka said, scan it with TagInfo. The first good sign would be it not having any / many applications / files (ideally there should be 0).
They may not know how to / they might not even have access to the keys… often the software stores / hides that information since with it you can access / modify any card for the system (potentially). Best thing to do is to ask them / use a test card.
Ok, I’ll try to explain. DESFire has one master key (think password) which allows for applications to be added and deleted. Then each application allows for up to 14 keys, with the potential for each one to have different permissions. Secure / well designed systems will only use the master key once - to create / delete applications in a secure facility to setup a card. Then two keys are usually added per application, one with read / write access (for admins / readers) and one with read only access.
Afaik, most access control systems do not allow entering a custom masterkey on a card level - you can change it, but that changes it for all cards…
Thus they do not want to share that master key, which is needed to create / modify your own applications.
The only way you might be able to get around this would be to create a NDEF application of a suitable size with keys you know before giving it to them for enrollment, and hoping that their system / process does not remove it.
Hope this makes things a bit clearer