Can APM change the default domain on an NTLM request?

So essentially you're disabling the access policy (and SSO) for anything that's not a browser. And that also assumes the client is internal and can do its own NTLM. I don't think you answered whether or not you were using the persistent cookie option in the access policy.