two VS, one APM and check AD group membership

You can create 2 APM policies and use SSO domain cookie. This will avoid authentication if user from app1 goes to app2 in same session or diffrent tab of same browser.

under domain cookie, type your site domain. e.g. example.com