When linking a custom Access Template which contains Deny Read/Write access to the edsaMoveMailbox attribute to the root of the Domain, the result is not as expected.
Instead of hiding the Move Mailbox Exchange Task, the task remains. It is possible to complete a move operation without error, but the move operation is never actioned by Active Roles.
The Access Template works as expected when applied to an Organizational Unit. Create a Managed Unit which returns all Organizational Units in the Domain and apply the Access Template to it.
Waiting for fix in a future version of Active Roles.