APM SSO Configuration

This should hopefully be quite a simple question. I'm trying to understand the difference between applying an SSO configuration on a portal access resource for example and then applying one directly on the access policy?

For example, lets say I have portal access configured and have SSO for a Kerberos authenticated website but also use have SSO configured using HTML forms. Given this scenario of having multiple SSO configurations, which one gets applied to the access profile?

Thanks in advance MP