Access to resource based on the Active Directory group.

For what it's worth, APM's logon page is only ONE way to collect credentials. You can also do client side Kerberos, PKI, Basic, and others. You can also customize the logon page. I've even seen an APM logon page that looked just like the OWA logon page.