TL;DR: The "Authentication failed" error means your Microsoft or Google email token has expired. Reconnect your email account in Settings to resolve it.
Who can do this
Any Uku user with a connected Microsoft or Google email account
Users on the Team or Enterprise plan with email sending enabled
Why does this happen?
This error occurs when your Microsoft or Google account token has expired. A token is a temporary security code that allows Uku to send emails on your behalf. Tokens need to be refreshed periodically, and when they expire, Uku can no longer authenticate with your email provider.
How to reconnect your email account
Open Settings.
Select Emails.
Select Email addresses.
Locate your email account (it will be highlighted in pink to indicate a connection issue).
Select that email account.
Select Reconnect.
After reconnecting, email sending should work again.
Resending failed emails
If email sending failed while your account was disconnected, you can resend those emails. Read here how to resend emails that failed to deliver.
Tip: If you frequently encounter this error, check whether your organization's security policies are causing tokens to expire sooner than expected. Your IT administrator may need to adjust token lifetime settings.
Microsoft 365 / Azure AD environments
If your organization uses Microsoft 365 with Azure AD (now called Microsoft Entra ID), your tenant may restrict which third-party applications users can grant permissions to. When these restrictions are active, individual users cannot reconnect their email in Uku until a tenant administrator approves the Uku Email app.
The "Need admin approval" popup
When you try to reconnect your email account and see a Microsoft popup saying "Need admin approval", it means your Azure AD tenant is configured to require administrator consent for third-party apps. You cannot bypass this popup yourself — it is controlled at the organization level by your IT administrator.
What your IT administrator needs to do
Ask your IT administrator to grant tenant-wide consent for the Uku Email application by following these steps:
Sign in to the Microsoft Entra admin center.
Navigate to Identity > Applications > Enterprise applications.
Find Uku Email in the application list.
Open the application page and go to Permissions.
Select Grant admin consent and confirm.
The following permissions are required for Uku to send and manage emails:
Permission | Purpose |
Mail.Read | Read incoming email (reply tracking) |
Mail.ReadWrite | Manage email drafts and folders |
Mail.Send | Send emails and invoices |
SMTP.Send | Send via SMTP protocol |
offline_access | Maintain connection without re-authentication |
Additionally, ensure that Authenticated SMTP is enabled for the relevant mailboxes in Exchange Online. Without this, SMTP-based sending will fail even if app permissions are granted. Your IT administrator can enable this in the Exchange admin center under the mailbox settings, or via PowerShell.
After admin consent is granted
Once your IT administrator grants consent, allow 15–40 minutes for the permissions to propagate across Microsoft's systems. After that delay, follow the standard reconnection steps:
Open Settings > Emails > Email addresses.
Select your email account (highlighted in pink).
Select Reconnect.
Complete the Microsoft sign-in. The "Need admin approval" popup should no longer appear.
Troubleshooting
Reconnect button does not appear: Make sure you are viewing the correct email account entry. If the account is not highlighted in pink, the issue may be different from an expired token.
Error persists after reconnecting: Sign out of your Microsoft or Google account in your browser, then try the reconnect process again. This forces a fresh authentication.
Multiple email accounts affected: If all connected email accounts show the error simultaneously, check whether your organization recently changed security policies or revoked third-party app permissions.
Invoices still failing after reconnection: Verify that your email account is set as the default sender for invoices under Settings > Emails > Email addresses.
"Need admin approval" popup (Microsoft 365): This means your Azure AD tenant requires administrator consent. Ask your IT administrator to grant permissions for the Uku Email app as described in the Microsoft 365 / Azure AD environments section above. After consent is granted, wait 15–40 minutes before retrying.