When device users run the Knox Manage Agent, the defined policies pushed from the Knox Manage console are applied to the device. If you remove the policies that maintain appplication settings, it doesn’t return the settings to their default values, as the KM agent is still the device administrator. When you configure app permission settings by policy, these become the “default” value to the application.

To change this, you will need to remove the policy that sets the “Grant” permission. Then, you will have to push a new policy configuration to the device in order to change this value to “Prompt” or “Deny”, as desired for the package names listed.

Two other approaches to this are:

1. Uninstalling and then reinstalling the application.
2. Removing the KM agent as the device administrator (i.e. un-enrolling the device from Knox Manage).