If you’ve got a user who gets an Access Denied error similiar to the one below when they click on Options in Outlook Web Access (OWA), they may not have the MyBaseOptions role. Typically this happens because the user has lost their Role Assignment Policy. You can check this with the following PowerShell command, substituting the name of the mailbox you want to check:
Get-Mailbox bdesmond | fl *role*
If you don’t get results similiar to the following (e.g. the result is blank), you need to assign the policy to the user.
RoleAssignmentPolicy : Default Role Assignment Policy
To assign the Default Role Assignment Policy to a mailbox, do something similar to the following, substituting the correct mailbox name:
Get-Mailbox bdesmond | Set-Mailbox -RoleAssignmentPolicy "Default Role Assignment Policy"
There shouldn’t typically be any users in your organization who have this setting null’ed out, but, I and others have seen this happen after you disconnect and reconnect a mailbox to the user.