I can't seem to find the right combo of settings to get this to work. I have a room that needs to restricted to only one AD security group. I am running Exchange 2013

My settings are below. At lest the ones I think are related to the restrictions I need. The AD security group is call HR.

Get-CalendarProcessing -id Building1 | select *Policy*,*Resource*

RequestOutOfPolicy    : {}
AllRequestOutOfPolicy : False
BookInPolicy          : {biz.com/HR/HR_staff}
AllBookInPolicy       : True
RequestInPolicy       : {}
AllRequestInPolicy    : False
ResourceDelegates     : {biz.com/HR/staff/smithj}

Set AllBookInPolicy  to $false