I had this until I created a DNS record internally.
I had to create an A record of autodiscover. under my public DNS name internally schoolname.co.uk zone pointing autodiscover.schoolname.co.uk to autodiscover.outlook.com
HTH
Sorry guys, someone posted saying something like
"Are great"
I checked their profile and they had one post and were banned. I thought it may be advertising. I was on the EduGeek app.
My bad!
HAP follows NTFS permissions. Deny that user / group write permissions in Security on the folder and you should be fine. We have an area here that pupils cannot read to and on HAP the Upload button doesn't appear.