APM Auth Domain cookie

Your question is not clear to me, but:

1- The cookie-domain setting specifies the scope of the MRHSession cookie that's transmitted by APM to your client PCs for session tracking.

2- If your client transmits the cookie back to APM (and the session is "within scope" -- see the session scope setting), then the HTTP request is associated with the user session.

3- This setting is valid for all Access Profile types.

That's the front-end. Now on the back-end, Portal Access uses the reverse proxy so that the hostname is more or less invisible to the client PC. It doesn't matter what that domain is. For more general information on use case types and how APM works, troubleshooting, etc, please see the "APM Operations Guide". That, along with some knowledge of Web browsers, HTTP, and cookies should give you a good understanding of the general operating principles.