As far as I understand:

If you don't tick the options in the enrollment rule, the permissions are not set. As soon as the agent (or may be another app, I am not sure) needs one of those permissions it will ask the user for granting them.

If you tick the options it depends on device model and MobiControl plugin what happens.

I.e. on Honeywell devices all permissions will be granted automatically after installing the Honeywell MC plugin.
On ZEBRA devices all but one permission (change system settings) will be granted by the ZEBRA MC plugin.

All permissions which could not be granted automatically are popping up in the MC agent when enrolling the device. The user must grant these permissions manually.

@all: Please correct me, if I am wrong. This topic is also quite new to me. ;)

Good answer Simon,

To clarify: Some permissions for some OEMs require manual setup, therefore we added a way on enrollment to request those permissions. If they can be granted automatically, the agent won't prompt for it. It all depends on the OEM and their own expected behavior.

Regards,

Thanks @Simonbreuer, 

How can i check if the ones i am using are auto granted?

After the enrollment is complete you can send the following scripts to the device.

request_appops_permission android.permission.WRITE_SETTINGS

request_appops_permission android.permission.PACKAGE_USAGE_STATS

request_appops_permission android.permission.SYSTEM_ALERT_WINDOW

request_appops_permission android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

If one or some of the permissions are not granted, MC Agent will request you to manually set them.
On the other hand, if all of these permissions were granted before, there won't be any message/pop-up.

Sending this script is a good way to see, which permissions are missing.

Hello,

Im trying with Bluebird, Samsung and Huawei devices (AE fully managed and COPE). In all devices and enrollments types I need to give permissions manually after enrollment :( 

Of course, in all enrollment rules, checks for auto enrollment permissions are accepted.

I have also tried to send legacy script: