Consider the following scenario:
You create a mail-enabled universal security group in a Microsoft Exchange Server 2013 environment.
You create a resource mailbox, such as a meeting room.
You set the group as a resource delegate on the resource mailbox by running the Set-CalendarProcessing cmdlet.
In this scenario, the members of the universal security group do not have permission to add delegates to the resource mailbox.
This issue occurs because the group is added to the Active Directory object attributes of the resource mailbox. However, the group is not added to the Access Control Entry for the respective folders of the resource folder.
To resolve this issue, install Cumulative Update 7 for Exchange Server 2013.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.