Users will have the same permissions in the Sandbox that they currently have in their Live Database. 

If the User account was created after the Sandbox was created, the Sandbox will need to be refreshed so that the permissions will be included