Are AppDomains are created for every request?

I'm sorry to say that your colleague is correct. Within an ASP.NET application, each application configured as such in IIS runs within its own AppDomain, which is the scope of a singleton object. So a singleton in App1 is available to all requests to App1 (and could become a concurrency if not handled carefully), but requests in App2 would not be able to access the singleton in App1.

_{(source: microsoft.com)}

This diagram from MSDN Magazine helps show how each application is isolated in its own AppDomain. While the diagram shows an IIS5 worker process (aspnet_wp.exe), an IIS6 worker process would be similar for applications configured to run in the same Application Pool.