How do storefront associations work and what needs to be enabled

First, in configuration settings SA Enabled needs to be set to true. Then there are three levels you can enable to allow access respectively to community, account group and account. If any of these is enabled then an existing CC Storefront Association. record needs to exist and the system checks at each next level whether the logged in user has access. The main goal is to restrict access to a given storefront when there are multiple storefronts to a single community as the user would otherwise have access to any given their access is set through profile at the community level.