SharePoint and OneDrive in SQL – files (sharepoint://), Excel workbooks, SharePoint lists, search and change feeds
Compatibility Matrix
This table covers all DuckDB releases that have not reached end-of-life, including LTS releases, and shows the 2 most recent patch releases of each. Older patch releases are not listed, but the extension may be available for them as well.
| Platform | 1.4.4 | 1.4.5 | 1.5.5 | 1.5.6 | 2.0.0 |
|---|---|---|---|---|---|
| Linux AMD64 | |||||
| Linux ARM64 | |||||
| macOS AMD64 | |||||
| macOS ARM64 | |||||
| Windows AMD64 | |||||
| Windows ARM64 | |||||
| WebAssembly |
Installing and Loading
INSTALL sharepoint FROM community;
LOAD sharepoint;
Example
-- App-only auth: an Entra ID app registration with the Sites.ReadWrite.All
-- APPLICATION permission and admin consent. Bind it to a document library
-- by DRIVE_ID (a Graph drive id) or SITE_ID.
CREATE SECRET sp (
TYPE sharepoint,
PROVIDER client_credentials,
TENANT_ID '00000000-0000-0000-0000-000000000000',
CLIENT_ID '11111111-1111-1111-1111-111111111111',
CLIENT_SECRET '...',
DRIVE_ID 'b!AbCdEf...'
);
-- Read a file by path -- one Graph call, no per-segment walk.
SELECT count(*) FROM 'sharepoint://Finance/2026/actuals.parquet';
-- Address by driveItem id instead -- stable across a rename.
SELECT * FROM read_csv('sharepoint://id:01ABCDEF23456789');
-- Glob a folder.
SELECT * FROM read_parquet('sharepoint://exports/parts/*.parquet');
-- Write a file. Sequential only; streamed in bounded memory.
COPY (SELECT * FROM t) TO 'sharepoint://reports/out.parquet' (FORMAT parquet);
About sharepoint
Registers a sharepoint:// filesystem backed by Microsoft Graph, so any
DuckDB path expression can address a file in a SharePoint document library
or OneDrive with no download step. Because DuckDB dispatches file access
through its virtual filesystem, read_parquet, read_csv, COPY, glob
and DuckLake all inherit the scheme.
Unlike Google Drive, Graph addresses items by path, so there is no
path-resolution cache and no duplicate-name ambiguity. Reads are ranged
and served from a block cache. Writes stream through a Graph upload session
in bounded memory and the file appears when it is closed (Graph cannot
write at a byte offset, so positional writes raise rather than corrupt).
Beyond files: read_excel_table / read_excel_range read live Excel
workbooks and COPY ... (FORMAT excel_table | excel_range) writes them
back; read_sharepoint_list reads SharePoint lists as typed tables (WHERE
pushed down to Graph on indexed columns) and COPY ... (FORMAT
sharepoint_list) creates or updates items; read_sharepoint_files lists a
library with its metadata; search_sharepoint runs Microsoft Search;
sharepoint_changes returns the files changed since a token;
?version= reads an earlier version of a file.
Besides app-only client credentials or a certificate, a user can sign in
with device_code or authorization_code. Also registers the
scheme-generic write_blob, remove_file, move_file and file_size SQL
functions, which work for any filesystem DuckDB can reach.
This is SharePoint / OneDrive via Microsoft Graph, not Azure Blob
Storage — a different product with a different API. For az:///abfss://
containers use the azure extension.
Added Functions
| function_name | function_type | description | comment | examples |
|---|---|---|---|---|
| file_size | scalar | Byte length of the file at path, or NULL if it does not exist. Reads only metadata – unlike read_blob, which downloads the body. |
NULL | [SELECT file_size('data/part.parquet')] |
| move_file | scalar | Rename/move source to target, returning true on success and raising on failure. Both paths must live on the SAME filesystem – this is a rename, not a copy. Its main use is publishing a fully-written temporary file under its final name. |
NULL | [SELECT move_file('staging/part.tmp', 'data/part.parquet')] |
| read_excel_range | table | Read a range of an .xlsx in SharePoint / OneDrive, live through the Graph workbook API: 'Sheet!A1:F200', or a sheet name for its used range. The first row is the header unless header := false. all_varchar := true reads every column as text. | NULL | [SELECT * FROM read_excel_range('Finance/plan.xlsx', 'Input!A1:F200'), SELECT * FROM read_excel_range('Finance/plan.xlsx', 'Input', header := false)] |
| read_excel_table | table | Read a named Excel table from an .xlsx in SharePoint / OneDrive, live through the Graph workbook API: the header row gives the column names, the values and number formats the types (dates included). The path is a sharepoint:// path (the scheme may be left out) or id: |
NULL | [SELECT * FROM read_excel_table('Finance/plan.xlsx', 'Sales')] |
| read_sharepoint_files | table | A document library's files and their metadata, one row per file matching a sharepoint:// path or glob: path, name, size, created/modified and by whom, content type, id, web URL, then the library's own columns, typed as read_sharepoint_list types a list's. | NULL | [SELECT name, size, modified_by FROM read_sharepoint_files('sharepoint://Finance/*/.xlsx')] |
| read_sharepoint_list | table | Read a SharePoint list as a table through Microsoft Graph: one row per item, one typed column per list column (named by its display name), plus id, created and modified. The list is named by its name or as id: |
NULL | [SELECT * FROM read_sharepoint_list('Orders'), SELECT * FROM read_sharepoint_list('Orders', site := 'Sales')] |
| remove_file | scalar | Delete the file at path, returning true if it existed and was removed and false if it did not exist. Dispatches on the path's scheme through DuckDB's virtual filesystem, so it works for local paths and for every remote scheme an extension registers (gdrive://, sharepoint://, s3://, …). Remote stores may keep a deleted file in a trash or recycle bin (see the extension's *_permanent_delete setting). Folders are refused. Errors other than not-found are raised, not returned as false. |
NULL | [SELECT remove_file('reports/old.parquet')] |
| search_sharepoint | table | Microsoft Search across the tenant's files, list items and sites (types := ['driveItem', 'listItem', 'site']), as rows: type, name, a sharepoint:// path for a file in the secret's drive, id, web URL, drive, site and list ids, size, times, who modified it, the hit summary and its rank. App-only search finds the tenant's region itself, or takes region := 'EUR'. | NULL | [SELECT name, path, modified FROM search_sharepoint('quarterly forecast'), SELECT name, web_url FROM search_sharepoint('Sales', types := ['site'])] |
| sharepoint_changes | table | What changed under a sharepoint:// folder since a token (Graph's delta query): one row per file or folder added or changed (_change 'upsert') or deleted ('delete'), then one 'checkpoint' row whose token column is the token for next time. Without a token: everything (a full listing); token := 'latest': nothing, just a token from now on. | NULL | [SELECT * FROM sharepoint_changes('sharepoint://Finance/'), SELECT * FROM sharepoint_changes('sharepoint://Finance/', token := 'aTE09…')] |
| sharepoint_reset_stats | table | Zero the counters reported by sharepoint_stats(). Process-wide: it disturbs a concurrent measurement in another connection. | NULL | [CALL sharepoint_reset_stats()] |
| sharepoint_stats | table | Microsoft Graph call counters, one row per metric: token_request, stat, read_range, list_page, upload_put, upload_session, upload_chunk, upload_commit, upload_abort, delete, move, create_folder (calls by kind), retries, throttled, bytes_read, bytes_written, meta_cache_hits (opens served from the sharepoint_immutable_prefixes metadata cache), auth_refresh (401s answered by a fresh token), workbook (Excel workbook API calls), list (SharePoint site/list/item pages) and upload_buffer_peak (a HIGH-WATER MARK: the most bytes one file being written held in memory). Process-wide; reset with sharepoint_reset_stats() to measure what one query costs. | NULL | [SELECT * FROM sharepoint_stats()] |
| sharepoint_version | scalar | Returns the version of the loaded sharepoint extension. | NULL | [SELECT sharepoint_version()] |
| sharepoint_versions | table | A SharePoint file's version history, newest first: the version label, a path that reads that version (sharepoint://…?version= | NULL | [SELECT * FROM sharepoint_versions('sharepoint://Finance/plan.xlsx'), SELECT * FROM read_parquet('sharepoint://Finance/actuals.parquet?version=3.0')] |
| write_blob | scalar | Write content to path, replacing any existing file, and return the number of bytes written. The inverse of read_blob(): together they give SQL a byte-exact round trip for any filesystem DuckDB can reach, local or remote. Accepts arbitrary binary content – a BLOB, not a VARCHAR. |
NULL | [SELECT write_blob('notes/readme.md', '# Title'::BLOB)] |
Overloaded Functions
This extension does not add any function overloads.
Added Types
This extension does not add any types.
Added Settings
| name | description | input_type | scope | aliases | typed_value |
|---|---|---|---|---|---|
| datazoo_banner | Show the DataZoo feedback banner when an extension is loaded in an interactive terminal (at most once a day per extension). | BOOLEAN | GLOBAL | [] | true |
| sharepoint_block_size_bytes | Block size for cached reads (default 8 MiB, at most 64 MiB; 0 disables the cache and reads exact ranges). | UBIGINT | GLOBAL | [] | 8388608 |
| sharepoint_debug_token_max_age_seconds | TESTING ONLY: treat access tokens as expiring after at most this many seconds (0 = their real lifetime). | BIGINT | GLOBAL | [] | 0 |
| sharepoint_device_code_timeout_seconds | How long PROVIDER device_code waits for the user to finish signing in (default 900, at most 3600; also capped by the device code's own lifetime). | BIGINT | GLOBAL | [] | 900 |
| sharepoint_graph_endpoint | Base URL for Microsoft Graph (default https://graph.microsoft.com). Set for national clouds such as https://graph.microsoft.us or https://microsoftgraph.chinacloudapi.cn. | VARCHAR | GLOBAL | [] | https://graph.microsoft.com |
| sharepoint_immutable_prefixes | Comma-separated sharepoint:// path prefixes whose files are never overwritten in place (e.g. a DuckLake DATA_PATH). Skips the per-open metadata refresh for them. Matching is on whole path segments. Empty (the default) disables it. | VARCHAR | GLOBAL | [] | |
| sharepoint_list_page_size | Items per Graph page when reading a SharePoint list (default 999, between 1 and 999). | BIGINT | GLOBAL | [] | 999 |
| sharepoint_login_endpoint | Base URL for the Azure AD login authority (default https://login.microsoftonline.com). Set for national clouds, e.g. https://login.microsoftonline.us. | VARCHAR | GLOBAL | [] | https://login.microsoftonline.com |
| sharepoint_permanent_delete | RemoveFile permanently deletes instead of moving to the recycle bin (default: false). | BOOLEAN | GLOBAL | [] | false |
| sharepoint_telemetry_enabled | Enable or disable anonymous usage telemetry for the sharepoint extension. | BOOLEAN | GLOBAL | [] | true |
| sharepoint_upload_chunk_bytes | Upload chunk size, and the most memory one file being written holds (default 10 MiB; rounded down to a multiple of 320 KiB and capped below 60 MiB per the Graph upload-session contract). Files up to this size upload in one PUT on close; larger ones stream through a resumable upload session as they are written. | UBIGINT | GLOBAL | [] | 10485760 |
| temp_directory | Set the directory to which temporary files are written. | VARCHAR | GLOBAL | [] | post.db.tmp |
© 2026 DuckDB Foundation, Amsterdam NL