From your admin console, in the Policies tab > Apps management section, you can set the default response for future runtime permission requests by applications (read contacts, access the camera, read the content…).
By default, this is set on “Prompt new permission”, meaning everytime an app will need a permission, it will be asked to the end user through its device. By choosing automatically granted or automatically denied, all future permissions will be accepted or forbidden directly.
If you want to manage permissions of each app independently, click on the top right corner of the app and select Permissions.
The list of permissions that could be prompted for this app is shown, and you can choose from here to enabled/disabled them. Please note that if you select “Automatically denied” for one app in particular, this permission will be denied even if you set the global default response for future runtime permission requests to “Automatically granted”.