Enabling the MoneyGuide Pro Integration

Learning Team

Please note: This content is intended for Practifi System Administrators and is technical. The steps described in this article may not be completed without System Administrator permissions. Please discuss your integration installation plans with your Practifi Customer Support Team for their assistance.

Overview

MoneyGuide Pro is a goals-based financial planning platform by Envestnet | MoneyGuide that helps advisors have more engaging client conversations and deliver clearer financial plans. When you enable the MoneyGuide Pro integration with Practifi, your advisors gain a seamless single sign-on experience, accessing MoneyGuide Pro directly from the Household page with a single click and no separate login to manage, keeping client conversations on track instead of context-switching between systems.

The integration creates an identity and data bridge between Practifi and MoneyGuide Pro using modern authentication standards: SAML 2.0 for outbound authentication (Practifi to MoneyGuide) and OAuth 2.0 JSON Web Tokens (JWT) for inbound API calls (MoneyGuide back to Practifi). This architecture ensures secure, frictionless access while keeping your client data properly protected and auditable.

This article guides you through enabling the MoneyGuide Pro integration, understanding the integration architecture, assigning permission sets, verifying custom settings, and testing the connection. For guidance on how advisors will use MoneyGuide Pro day-to-day, see the companion article, Using the MoneyGuide Pro Integration.

Prerequisites
Understanding the Integration Architecture
Requesting Enablement
Assigning Permission Sets
Verifying Custom Settings
Testing and Verification
Certificate Management
Security Considerations
Known Limitations

Prerequisites

Before requesting the MoneyGuide Pro integration enablement, ensure that your organization and users meet the following requirements:

Requirement	Details	How to Verify
Practifi Lightning Version or Later	The MoneyGuide Pro integration requires Practifi Lightning or a later product version. Earlier versions do not support the required SAML and OAuth authentication protocols.	Log in to your Practifi instance and check the version number in the footer of the Setup page.
My Domain Enabled	Please ensure your domain is enabled in your Practifi instance. This is required for SAML-based single sign-on and is a standard Salesforce security feature.	In Practifi, navigate to Setup > My Domain. Verify that a custom domain has been created and deployed.
Active MoneyGuide Pro Account and License	Your organization must have an active subscription and seat licenses for MoneyGuide Pro. Contact your MoneyGuide Pro account representative to confirm your subscription status and license count.	Verify with your MoneyGuide Pro account representative or log in to your MoneyGuide Pro instance to confirm subscription details.
Salesforce System Administrator Access	The person managing the integration setup must have Salesforce System Administrator permissions in your Practifi instance.	In Practifi, navigate to Setup > Users. Confirm that your user account has the System Administrator profile or equivalent role.
Network Connectivity	Your organization and advisors must have network access to MoneyGuide Pro servers ([moneyguide.com](http://moneyguide.com) and related subdomains). If your organization uses a firewall or proxy, ensure that outbound HTTPS connections to MoneyGuide servers are allowed.	Test by attempting to access MoneyGuide Pro directly from your network. Contact your IT team to verify that firewall rules allow outbound connections to [moneyguide.com](http://moneyguide.com).

Understanding the Integration Architecture

The MoneyGuide Pro integration works by creating a secure authentication bridge between Practifi (the Identity Provider) and MoneyGuide Pro (the Service Provider). This architecture is built on industry-standard protocols and ensures that users are authenticated once in Practifi and then automatically authenticated in MoneyGuide Pro without requiring separate credentials.

How the SAML 2.0 and OAuth 2.0 Flows Work

When an advisor clicks the MoneyGuide Pro link on a Household page, the integration uses two authentication protocols working together:

Outbound Authentication (SAML 2.0): Practifi acts as the Identity Provider and sends a SAML assertion to MoneyGuide Pro. This assertion contains the advisor's identity and household information. MoneyGuide Pro validates this assertion with a certificate and then creates an advisor session without requiring them to log in separately.
Inbound API Calls (OAuth 2.0 JWT): MoneyGuide Pro makes secure API calls to your Practifi instance to retrieve additional client demographic data (address, phone, and email) as needed. These calls use OAuth 2.0 with JSON Web Token (JWT) signing to ensure that MoneyGuide Pro is authorized to request this data.

Data Flow Diagram

The following diagram illustrates how data flows between Practifi, the advisor, and MoneyGuide Pro:

Practifi (Identity Provider & Data Source)	SAML Assertion (User identity, Household ID, Org ID)	MoneyGuide Pro (Service Provider & Planning Tool)

OAuth 2.0 JWT: MoneyGuide requests client demographics from the Practifi API
Practifi API (Returns client data)	Client Demographics (Address, phone, email)	MoneyGuide Pro (Uses data for planning)

Key Information Transmitted

The MoneyGuide Pro integration transmits the following information between systems:

From Practifi to MoneyGuide Pro (in SAML assertion): User first name, user last name, Household ID, Organization ID, and Installation ID.
From MoneyGuide Pro to Practifi (via OAuth 2.0 API): Requests for client demographic data (address, phone number, and email address) to enhance planning context.
Data Ownership: Practifi is the source of truth for all client demographic data. MoneyGuide Pro may store copies of this data to support the planning process, but your authoritative records remain in Practifi.

Requesting Enablement

The MoneyGuide Pro integration is not self-service. Your Practifi Customer Support Team works with the Practifi integration team to configure SAML, OAuth, and certificate settings on your behalf. To begin the enablement process, contact Practifi Support.

What to Provide in Your Enablement Request

When you contact Practifi Support to request MoneyGuide Pro enablement, have the following information ready:

Your organization name and Practifi instance URL.
Your active MoneyGuide Pro account details (organization name and account ID from MoneyGuide).
The number of advisors who will use the MoneyGuide Pro integration.
Confirmation that your instance is Practifi Lightning or later and that My Domain has been enabled.
The name and email address of a System Administrator who will manage the integration on your behalf.

The Practifi support team will handle the technical configuration, including SAML certificate creation, OAuth client setup, and custom settings configuration. This typically takes 2–5 business days, depending on your organization's verification and configuration requirements.

Assigning Permission Sets

Once Practifi enables the integration, you must assign two permission sets: one to advisors who need access to MoneyGuide Pro, and one to a dedicated integration user who runs the API calls. Together, these permission sets grant the minimum necessary access for advisors and the integration to operate securely, with no broader privileges than those required by the integration.

Permission Set 1: Practifi—Money Guide Pro

This permission set enables advisors to access MoneyGuide Pro from Practifi. To assign this permission set:

In Practifi, navigate to Setup > Users.
Click the username of the advisor who will use MoneyGuide Pro.
In the Permission Set Assignments section, click Edit Assignments.
Locate Practifi—Money Guide Pro in the Available Permission Sets list.
Click the permission set to move it to the Assigned Permission Sets column.
Click Save.

Please note: If you are assigning the permission set to multiple users, you can use Practifi's bulk assignment feature through Setup > Permission Sets > Manage Assignments to streamline the process.

Permission Set 2: Practifi—Money Guide Pro API

This permission set enables the MoneyGuide Pro integration to read client data from your Practifi instance via the API. Assign this permission set to a special integration user (an automated user account) rather than to individual advisors. If you do not already have an integration user for this purpose, contact Practifi Support.

In Practifi, navigate to Setup > Users.
Create or locate your integration user (typically named MoneyGuide Pro Integration User or a similar name).
Click the user name to open the user record.
In the Permission Set Assignments section, click Edit Assignments.
Locate Practifi—Money Guide Pro API in the Available Permission Sets list.
Click the permission set to move it to the Assigned Permission Sets column.
Click Save.

Please note: The integration user must remain active and must not have an expiration date. If you deactivate or expire this user, the OAuth connection will fail, and MoneyGuide Pro will not be able to retrieve client data.

Verifying Custom Settings

The MoneyGuide Pro integration uses a custom settings object, Money Guide Pro Integration Settings, to store per-profile configuration, specifically the Identity Provider-Initiated Login URL. This URL is used when advisors access MoneyGuide Pro from Practifi.

How to Verify Custom Settings

In Practifi, navigate to Setup > Custom Settings > Money Guide Pro Integration Settings.
Verify that the custom settings record exists. You should see at least one entry in the list.
Click on the setting to view or edit it, and confirm that the IdP-Initiated Login URL field contains a valid URL. It will look like a SAML-formatted URL with your Practifi instance domain.
Confirm that the custom setting is mapped to the appropriate user profiles. The MoneyGuide Pro integration should be available to any profile with access to Households.

If the custom settings record does not exist or the IdP-Initiated Login URL is blank, contact Practifi Support to complete the configuration.

Custom Field for Household ID Storage

During the SAML authentication flow, Practifi temporarily uses a custom field, practifi__MGP_Client_Id__c, on the Account object to store the Household ID. This field is used internally during the SAML assertion processing and is automatically cleared after the flow completes. You do not need to manage this field directly, but you may see it appear in audit logs or API debugging. Do not delete or modify this field.

Testing and Verification

Before rolling out the MoneyGuide Pro integration to your advisors, verify it is working correctly by following the checklist below. Catching configuration issues here keeps your launch smooth and avoids disruptions to advisors once the integration is in active use.

Verification Checklist

Component	Expected Behavior	How to Check
Permission Sets Assigned	Advisors can see the MoneyGuide Pro button or link on the Household page.	Log in as a test advisor with the MoneyGuide Pro permission set assigned. Navigate to a Household record. Verify that a MoneyGuide Pro link or button is visible.
Single Sign-On (SSO)	Clicking the MoneyGuide Pro link automatically authenticates the user in MoneyGuide Pro, eliminating the need for a separate login.	Click the MoneyGuide Pro link from a Household page. You should be taken directly to MoneyGuide Pro without a login prompt. If prompted to log in, the SAML configuration may be misconfigured.
User Identity Transmitted	MoneyGuide Pro recognizes the advisor's name and organization.	After accessing MoneyGuide Pro through the SSO link, verify that the advisor's profile or account information is displayed correctly in MoneyGuide Pro (usually in the top-right menu or account settings).
Household Context	MoneyGuide Pro displays the correct household context (client name and relevant information).	In the MoneyGuide Pro session, verify that the household name and any pre-populated client information matches the household you clicked from in Practifi.
Client Demographics API	MoneyGuide Pro can retrieve and display client demographic data (address, phone, and email) from your Practifi instance.	Check that the address, phone, and email fields are populated in MoneyGuide Pro for a household that has this information in Practifi. If fields are blank when they should be populated, the OAuth API connection may need to be troubleshooted.
Custom Settings Configured	Custom settings record exists and contains a valid IdP-Initiated Login URL.	In Practifi, navigate to Setup > Custom Settings > Money Guide Pro Integration Settings. Verify that the record exists and that the URL field is populated.

Step-by-Step Testing Process

Test user setup: Create or select a test user and assign the Practifi—Money Guide Pro permission set.
Log in as test user: Log in to Practifi as the test user.
Navigate to a Household: Open a Household record that contains test client data (address, phone, and email fields populated).
Click the MoneyGuide Pro link: Look for a MoneyGuide Pro link or button. Click it to initiate the SSO flow.
Verify authentication: Confirm that you are taken directly to MoneyGuide Pro without a login screen. If a login prompt appears, contact Practifi Support.
Check user context: Verify that your name and organization appear correctly in MoneyGuide Pro.
Verify household data: Confirm that client demographics (address, phone, and email) are displayed in MoneyGuide Pro.
Test with another user: Repeat this process with at least one additional test user to ensure the setup is consistent.
Verify there are no errors in the logs: Check your Practifi Setup Debug Logs or API logs for any authentication failures or errors. Contact Practifi Support if you see recurring error patterns.

Certificate Management

The MoneyGuide Pro integration uses a self-signed SAML certificate to sign authentication assertions. This certificate is created by the Practifi integration team during enablement and is deployed to your Practifi instance.

Certificate Renewal and Expiration

Like all certificates, the SAML certificate used for MoneyGuide Pro has an expiration date. Practifi proactively monitors certificate expiration and will notify you well in advance (typically 90 days before expiration) if renewal is required. When a renewal is needed, Practifi Support will coordinate the certificate replacement with minimal disruption to your integration, so advisors continue using MoneyGuide Pro without an interruption to their workflow.

You do not need to manage the certificate renewal process manually. Please make sure your organization receives and reads Practifi Support notifications about upcoming certificate expirations so you can plan accordingly, including any required maintenance windows.

Security Considerations

Data Transmission and Encryption

All communication between Practifi and MoneyGuide Pro occurs over encrypted HTTPS connections. SAML assertions and OAuth tokens are cryptographically signed to ensure authenticity and prevent tampering. No passwords or sensitive credentials are transmitted between systems.

Single Sign-On and User Session Management

When an advisor accesses MoneyGuide Pro via the integration, a new MoneyGuide Pro session is created tied to their Practifi authentication. Logging out of MoneyGuide Pro does not automatically log out Practifi; these are separate sessions. Advisors should log out of both systems when stepping away from their computers.

API Permissions and Data Access

The integration user (the account that makes API calls to retrieve client demographics) is assigned minimal necessary permissions through the Practifi—Money Guide Pro API permission set. With this integration, the user cannot perform any actions in Practifi other than retrieving the client data needed to support the planning session. Regularly review the permission set assignments to ensure that only authorized users and the integration account have access to the MoneyGuide Pro features.

Audit and Logging

All SAML authentications and API calls are logged in your Practifi instance. These logs can be reviewed through the Setup Debug Logs page if you need to troubleshoot authentication issues or audit who has accessed the MoneyGuide Pro integration and when. Maintain these logs for your organization's security and compliance purposes.

Known Limitations

Be aware of the following limitations and constraints of the MoneyGuide Pro integration:

Installation ID Fixed: The integration uses fixed values for Integration ID (197) and Installation ID (400). These cannot be customized without contacting Practifi Support.
SAML Attributes Limited: The SAML assertion transmits only user identity, Household ID, Organization ID, and Installation ID. Other Practifi custom fields are not included in the assertion. If you need additional data to be passed to MoneyGuide Pro, contact Practifi Support to discuss configuring custom SAML attributes.
One-Way Data Flow for Planning Sessions: The integration provides single sign-on access to MoneyGuide Pro and enables it to pull client demographics. Planning recommendations and notes created in MoneyGuide Pro are not automatically written back to Practifi. Your advisors must manually transfer relevant planning outcomes to Practifi if needed.
Household-Level Access Only: The MoneyGuide Pro link is only available from the Household page. Access is not enabled from other pages (such as Contact or Opportunity pages).
No Bulk Operations: The integration does not support bulk data synchronization, scheduled exports, or automated workflows triggered by MoneyGuide Pro events. All flows are initiated manually by advisors.

Support

If you encounter issues with the MoneyGuide Pro integration or have questions about configuration, contact Practifi Support through your Practifi customer portal. Provide details about the issue, including any error messages you observe and the steps you took to encounter the problem.