When the user is accessing the ADFS authentication function through a Web Application Proxy (i.e. the ADFS Proxy), it applies a different authentication policy. The default extranet password policy is Form Based Authentication. And the SSO cookie that ADFS delivers (regardless of where you connect from Intranet or Extranet) is a session cookie (it will die once you have closed your browser).
It works when you are connected internally because even if you don't have a SSO cookie, you will have SSO because of Kerberos/NTLM. So you might get a new cookie without knowing.
It works with Azure AD for other reasons. You might have already gotten a token or have a PRT (on a Windows 10 machine which is Hybrid Azure AD Joined)>
To have less prompts externally you could:
- Create your trust directly in Azure AD as an Enterprise Application. Even if your app is on-premises.
- Change the default authentication policy for extranet logon. This is not give you SSO, but you could opt for certificate based authentication, or Azure MFA as a first sign-in method (as opposed as Azure MFA as a secondary method kicking in after a password based authentication). This will not reduce the prompts, but change their nature. If the user just have to click on a certificate prompt or accept a notification on his/her phone, it might be less "disruptive".
- You can enable the Keep Me Sign-In feature. This make the SSO cookie a file/permanent cookie. This is described here. You can configure how long the cookie is valid for. There is a risk as if the user is using a shared computer, and if it doesn't clear the cookies, the next user will be taking over his/her session.