ASM and ADFS

Paul, I haven't done this myself, but my general opinion is if a http(s) service is published on the internet then a WAF will, in most cases, offer some protection and I would recommend it. This would be to prevent against known http rfc violations and general attacks, like xss.

A quick search on ADFS vulnerabilities returned this CVE which is a XSS vulnerability. So, a WAF in a purely negative model of security would help.

Hope this helps,

N