AD+ADFS (How to make?)

Azure AD has native support for SSO for applications that support ADFS: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-custom-apps

I'd recommend using that, it'll keep you away from unneccessary infrastructure and expenses and does not need anything extra like VM's or certificates.

If you do want to use ADFS itself, you'll need to build at least 1 VM with ADFS (component of Server 2016) and configure it with a certificate you buy. You'll need a fixed public IP, this is possible in Azure: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-deploy-static-pip-arm-portal

Site to Site vs public IP depends on where your clients are coming from, site to site is more expensive but also more secure.