Location of ADFS 3.0 Server

Hi,

I need to enable Single sign to create a hybrid environment between our On-Premise Exchange and our Skype for Business Online accounts.

As part of this I need to roll out an ADFS server. I have found mixed reports on whether this needs to sit on the DMZ or not. Can in sit internally in the network with the relevant ports allowed through our firewall or should I really be sticking this on a DMZ for security purposes.

Info I have found is that version 2.0 was very much for the DMZ but 3.0 can be either. Pretty new to this sort of setup so just wanted to confirm.

Thanks

David