Depending on the platform, the profiles should have the options to manage access to the photos. I work mostly with iOS devices. New profiles have most options enabled. You would use the profile to block. However, if you are using a Corporate Profile on a device that is to be used as a personal one, OR Created a Profile for COPE from a 'Copy' of a Corporate there may be a Corporate policy that disallows access to the photos.
Look at the phone record in the console and determine which profiles are installed on the device is question. Review all of the restrictions and compare against an enrolled, personally owned, device that does have access to the photos.