Edit: Re-wrote this to clarify some things.
We’re going to be using a mix of 365 licensing to achieve what we want. Management will have the full office suite, plus hosted Exchange (E3 plans). Supervisors will have Office web apps with hosted Exchange (E1 plans) and hourly employees will have hosted Exchange through OWA (K1 plans).
I’ve been asked to prevent employees from signing into Office 365 web services from outside the network, but allow them to get their email on personal devices through Exchange Activesync. I see that I can implement this using ADFS (http://technet.microsoft.com/en-us/library/hh526961(v=ws.10).aspx).
Here’s what I was hoping to get clarified
A: Can I use a wildcard SSL certificate (*.domain.com) instead of a simple SSL certificate for the ADFS servers? I ask because I’m not sure what servers ADFS will live on, and it could change after another project is implemented.
B: Do I need ADFS proxy servers in a DMZ if I won’t be letting users access 365 outside the LAN? I’m hoping that by only allowing Exchange ActiveSync, I wouldn’t need a proxy server.