Configuring ContactMonkey’s Trusted URLs in Microsoft Intune

To ensure accurate email tracking and proper asset loading for email recipients, your IT team needs to add ContactMonkey's domain URLs to Microsoft Intune's trusted sites list. Without this configuration, recipients may experience issues with images not displaying automatically or tracking data not being captured correctly.

Who should complete this setup: Your organization's IT team or a user with administrative access to Microsoft Endpoint Manager.

Important: The URLs you need to configure depend on your data region (US, EU, CA, or AU). Make sure to use the correct URLs for your region.

Configuration Methods

Choose one of the three methods below based on your organization's Intune setup and preferences.

Method 1: Administrative Templates Profile

1. Sign in to the Microsoft Intune admin center
2. Click Devices from the sidebar on the left-hand side
3. Click Configuration profiles in the Policy section
4. Click Create profile
   
    
5. Select Windows 10 and later in the Platform drop-down
6. Select Administrative Templates in the Profile drop-down
7. Assign a name and description to the profile
8. Click Next
9. Browse to Computer Configuration → Windows Components → Internet Explorer → Internet Control Panel → Security Page
10. Click Site to Zone Assignment List
11. Select Enabled and enter the domain URLs that correspond to the region in which your ContactMonkey account's data is stored in the Name fields
12. Enter "2" in the Value fields
13. Review and deploy

Method 2: Microsoft Managed Desktop

1. Sign in to the Microsoft Intune admin center
2. Click Devices from the sidebar on the left-hand side
3. Click Settings in the Microsoft Managed Desktop section
4. Click Trusted sites
5. Click Add trusted site
6. Enter the domain URLs that correspond to the region in which your ContactMonkey account's data is stored
7. Review and click Stage deployment 

Method 3: Settings Catalog

1. Sign in to the Microsoft Intune admin center
2. Click Devices from the sidebar on the left-hand side
3. Click Configuration in the Manage devices section
4. Click Create → New Policy
   
    
5. Select Windows 10 or later from the Platform drop-down
6. Select Settings catalog from the Profile type drop-down
7. Click Create
8. Assign a name and description to the profile
9. Click Next
10. Click Add settings
11. Enter "Site to Zone Assignment List" in the search bar
12. Click Select all these settings
    
13. Expand the Administrative Templates
14. Toggle on Size to Zone Assignment List
    
15. Enter the domain URLs that correspond to the region in which your ContactMonkey account's data is stored in the Name fields
16. Enter "2" in the Value fields
17. Click Next
18. Configure Scope Tags and User/Group Assignments as needed
19. Review and deploy

Regional URLs

Add all URLs listed for your organization's data region:

US Region

• https://contactmonkey.com (or your custom URL if applicable)
• https://cm-email-assets.s3.amazonaws.com
• https://7ohu5yf40b.execute-api.us-east-1.amazonaws.com/prod

EU Region

• https://tk.cmnky.co (or your custom URL if applicable)
• https://eu-cm-email-assets.s3.amazonaws.com/
• https://1urg7w1tvi.execute-api.eu-west-1.amazonaws.com/prod/
• https://contactmonkeyeu.com

CA Region

• https://tkca.cmnky.co (or your custom URL if applicable)
• https://ca-cm-email-assets.s3.amazonaws.com
• https://ir47efhw8b.execute-api.ca-central-1.amazonaws.com/prod/
• https://contactmonkey.ca

AU Region

• https://tkau.cmnky.co (or your custom URL if applicable)
• https://au-cm-email-assets.s3.amazonaws.com
• https://w4ap75wtnf.execute-api.ap-southeast-2.amazonaws.com/prod/
• https://contactmonkey.au

Note: If your organization uses a custom URL for ContactMonkey, replace the default tracking domain (ex: contactmonkey.com, tk.cmnky.co) with your custom URL.

Unblock File Downloads from the Trusted Sites Zone

Method 1: Settings Catalog Method (Recommended)

This is the most modern and direct way to configure the specific setting.

1. Sign in to the Microsoft Intune admin center.

2. Go to Devices → Windows → Configuration

3. Create a new profile (or edit the existing one that is blocking the download).

   • Platform: Windows 10 and later.

   • Profile type: Settings catalog.

4. On the Configuration settings page, click Add settings.

5. In the search box, search for "Allow file download".

6. Select the category "Internet Explorer" (or similar, depending on the browser being restricted) and find the setting:

   • Internet Explorer → Internet Control Panel → Security Page → Trusted Sites Zone → Allow file download

7. Click the setting to add it, and configure it as follows:

   • Allow file download: Set the toggle or dropdown to Enabled.

   • In the options below, for the "Allow file download" setting, select Enable.

8. Review the rest of the profile, assign it to the correct Users or Devices group, and then Create (or save) the profile.

Method 2: Administrative Templates Method

If you are using the older Administrative Templates profile type, the steps are very similar to the traditional Group Policy Object (GPO) path:

1. Sign in to the Microsoft Intune admin center

2. Go to Devices → Windows → Configuration

3. Create a new profile (or edit the existing one)

   • Platform: Windows 10 and later.

   • Profile type: Templates → Administrative Templates

4. On the Configuration settings page, navigate to User Configuration → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Trusted Sites Zone

5. Find the setting "Allow file download"

6. Double-click the setting and change it to Enabled

7. In the options dropdown for the setting, ensure Enable is selected

8. Review and Save the profile

See Also

• Configuring ContactMonkey's Trusted URLs in Group Policy