How to control access to multiple webapps behind a single virtual server using AD groups

You could try something like this:

when HTTP_REQUEST {
    if {[string tolower [HTTP::uri]] starts_with "/webapp1"}{
        if {not ([ACCESS::session data get session.ad.last.attr.memberOf] contains "CN=Webapp1-access")}{
            HTTP::respond 403
        }
    }
    elseif {[string tolower [HTTP::uri]] starts_with "/webapp2"}{
        if {not ([ACCESS::session data get session.ad.last.attr.memberOf] contains "CN=Webapp2-access")}{
            HTTP::respond 403
        }
    }
    elseif {[string tolower [HTTP::uri]] starts_with "/webapp3"}{
        if {not ([ACCESS::session data get session.ad.last.attr.memberOf] contains "CN=Webapp3-access")}{
            HTTP::respond 403
        }
    }
}