F5 Support have come through, many thanks Yasu. It appears that the logon field that captures the AD password has to be password1.
apm policy agent logon-page /Common/Citrix-APM__citrix_apm_act_logon_page_ag {
app-service /Common/Citrix-APM_.app/Citrix-APM_
customization-group /Common/Citrix-APM__citrix_apm_act_logon_page_ag
field-type3 password
post-var-name2 password1
post-var-name3 password
sess-var-name2 password1
sess-var-name3 password
}
"Variable Assign" also has to be changed as follows:
apm policy agent variable-assign /Common/Citrix-APM__citrix_apm_act_variable_assign_ag {
variables {
{
expression "mcget {session.logon.last.password1}"
varname session.logon.last.password
}
}
}