It will depend on what F5 software version you have. In the past, ASM only operated by injecting the token in fields on static HTML POST forms, and could not address other kinds of request or client-side-scripting-driven interactions.
It looks like more recently the CSRF feature can now inject client-side script to:
Apply the CSRF token to GET forms and plain links. This is a really bad idea—you don't want to leak your CSRF tokens in URLs.
Frob the XMLHttpRequest prototype to inject a fixed-value custom header X-TS-AJAX-Request: true
to bypass CSRF protection. This is workable but custom headers are the poor man's solution, compared to proper tokens; they have been vulnerable to edge-case attacks like that from Flash in the past.
These features, like much of what ASM does, are useful as a last-ditch/temporary workaround for when you have to deploy applications you know are insecure but you don't have the ability or permission to fix them properly. But if you can, it is much more reliable to address the problem in the application itself.