access policy to check for AD group membership based on URI

The variable "session.server.landinguri" will contain the first URI that triggered the access policy, and will not change each time you visit a new URI, so if you requested /home then /login, the first one will be your landing URI, the one that caused the creation of an APM session.

You shoud use another method to apply rules selectively depending on the requested URI, for example per request policy: Adding a URL branching rule (f5.com)