Logon using UPN without server side Kerberos on F5

if you used the iApp you can run it without APM and then do the authentication right on the exchange servers.

of course APM does give you some extra security. what you can do is perform an AD or LDAP lookup based on the SamAccountName and then get the UPN and use that as authentication username value.

here is something similar discussed: https://devcentral.f5.com/questions/using-apm-to-authenticate-to-windows-ad-with-a-upn-that-is-different-then-our-domain-name