two factor authentication for Exchange 2013 OWA

You can use a VPE action of "Client for MS Exchange" which is under "Endpoint Security (Server-Side)" to determine the client type connecting. If they are connecting from an MS Exchange client then you do the normal single factor auth and if they are in the "fallback" (OWA) then you present a logon page, etc. This should be how the iApp creates the APM policy.

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-config-11-4-0/apm_config_server_checks.html205575