Ldap query from ltm

So if I recall, we're working on a use case where one client type doesn't send the credentials in the initial request. All others do. Let's talk about a possible program flow.

client makes request to /Microsoft-Server-ActiveSync and does not have an MRHSession token - disable the policy for this request only    

Client traffic is passed through to server where the server asks for authentication in the response

Client sends authentication, like all other clients. Collect the credentials and store in the access policy    

You're most likely seeing requests to /my.policy in the server logs because of when and how you're disabling the policy.