UE does not need to (but it can if it is configured with one) to define APN. This can be a parameter fetched from HSS that is e.g. assigned as a default server for all the UEs in this PLMN for initial attach.
Only when a UE intends to create a PDN connection, it sends Attach request embedded with ESM PDN connectivity request, it indicates APN in the 'Access point Name' IE. Otherwise it would'nt. It would simply attach to the existing PDN(already connected previously). This link provides comprehensive PCAPs for all messages. http://www.sharetechnote.com/html/BasicCallFlow_LTE.html
From UE point of view, I want to know when UE triggers integrity protected Attach request and when it sends as plain message ?
Does UE send APN information while registering with network using the "Attach request" message ? How MME come to know that UE should attach to APN "XYZ" ?