APM SSO Configuration

This should hopefully be quite a simple question. I'm trying to understand the difference between applying an SSO configuration on a portal access resource for example and then applying one directly...