This is the second question I have seen about this recently...
Anyway this can be controlled by an OWA policy.
You will need to create a policy to remove the ability to change the photos, then adjust the policy to remove the permission:
Set-OwaMailboxPolicy -Name "Default OWA Policy" -SetPhotoEnabled $false
Then you will need to apply the policy to the mailboxes:
Get-Mailbox | Set-CASMailbox -OwaMailboxPolicy "Default OWA Policy"
If you already have an OWA policy in place, then adjust that instead. Remember that a user can only have only policy applied to their account (which you can see with get-casmailbox username) so if you are going to have multiple policies (allowing some to
change the photos) then plan carefully.
Simon.