We were under the impression that once on exch 2016 we would be able to use mail enabled security groups for shared mailboxes -- and (this is the important part) still be able to have the automapping feature work (ie. all members of the security group would see the share mailbox in their outlook profile)
The main issue I'm running into is the ability of users with full access rights given to them by a security group to a shared mailbox being unable to open an encrypted email sent to the shared mailbox. Issue described here Can't read encrypted or restricted message sent to shared mailbox in Outlook - Outlook | Microsoft L.... The only "fix" is assigning each user to have full access individually so that the mailbox is auto-mapped to Outlook for this functionality to work. Obviously this is not a fix in a large environment with hundreds of mailboxes and thousands of users.