Whoops, missed this question when it was first posted... I assume/hope you no longer need this answer a whole year later, but I figured I'd write up the details for posterity.
We do our own session management, not using the stuff built into ASP.NET, so I'm gonna leave those bits out. How you track who a user is is up to you. I'm also gonna leave out the changes made recently to support additional security for Stack Overflow for Teams.
When you come to one of our sites anonymously and log in, we look up the network account that matches the provided credentials and issue you a first-party cookie on the second-level domain you're on (e.g. stackoverflow.com, stackexchange.com, etc).
From there, we have to tell the other domains we have (six or seven in total at this time, if I recall right) that you have logged in. If we were Google or a similar entity with a ton of data centers everywhere, we'd probably just redirect you through all of them and set cookies that way, but... we are not. So we do this via an AJAX request for a 1px transparent image. The request includes a generated token and nonce that are verified on the other end. When that request comes back, it carries with it a third-party cookie for the domain it was sent to.
So, on any given login, we will create several session records on our end for your account, one on each domain. They are linked together by a "group identifier", so that when you log out, all of them are dropped at the same time. This identifier is also used to avoid auto-expiring sessions on domains that weren't visited recently enough when another active session with the same id is present.
When you visit a given Q&A site, we find your account and use that to find your user profile on that site if you are a member of that community, or show you a customized topbar that includes network-wide things like the inbox and achievements even if you don't.
This obviously doesn't work when the user has third-party cookies disabled, but in our case, it still gets most users 99% of the way there (since stackexchange.com covers the majority of our sites). In those cases, if/when you go to log in on a domain you weren't able to get a cookie for, that new session will get the same group identifier as the one you already have on whatever domain you first logged into. That way the sessions can still be kept in sync during logouts.
And that's about it.