OWA bruteforce protection with ASM

I've found that if I change the value of "Login Attempts From The Same Client" parameter to 1 I will have my OWA login page blocked after 3-4 of log in attempts.

And in this case Event Viewer shows the following violation:

Brute Force: Maximum login attempts are exceeded
Number of Login Attempts    1

But again I made 3-4 attempts.

As I can see such behaviour is not a BIG-IP issue but characteristic of OWA login procedure.

That's why I'm asking for a best practice for this kind of task.

Or all I need just use APM in this case?