Network SSO with Layered Virtuals

Hi,

I've read the guide on how to do this in Common Deployment Examples for Single Sign-On, but even after reading the section "Configuring network access for SSO with web applications" and subsequent sections I still do not understand what is happening here.

If I follow this guide and spin up an Edge Client VPN login does that mean any web services hosted on the same BIGIP with a relevant SSO item attached will gain the same sign-on credentials? The missing link appears to be what does this look like in the VPE...

Would really appreciate some guidance on how this is supposed to work.