Thank you for your response. You are correct in all of your assumptions. SSO will need to be used when the main account is created.
Here is the mockup:
