Tableau Connector for Microsoft Excel Online

Build 26.0.9770

Configuring a Connection

After Installing the Connector you can connect and create a Data Source for data in Microsoft Excel Online.

Setting Up a Data Source

Complete the following steps to connect to the data:

  1. Under Connect | To a Server, click More....
  2. Select the data source called Microsoft Excel Online by CData.
  3. Enter the information required for the connection.
  4. Click Sign In.
  5. If necessary, select a Database and Schema to discover what tables and views are available.

Using the Connection Builder

The connector makes the most common connection properties available directly in Tableau. However, it can be difficult to use if you need to use more advanced settings or need to troubleshoot connection issues. The connector includes a separate connection builder that allows you to create and test connections outside of Tableau.

There are two ways to access the connection builder:

  • On Windows, use a shortcut called Connection Builder in the Start menu, under the CData Tableau Connector for Microsoft Excel Online folder.
  • You can also start the connection builder by going to the driver install directory and running the .jar file in the lib directory.

In the connection builder, you can set values for connection properties and click Test Connection to validate that they work. You can also use the Copy to Clipboard button to save the connection string. This connection string can be given to the Connection String option included in the connector connection window in Tableau.

Connecting to Microsoft Excel Online

There are three authentication methods available for connecting to Microsoft Excel Online: Entra ID (Azure AD), Azure Service Principal, and Managed Service Identity (MSI).

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the connector to access Microsoft Excel Online endpoints securely.

Authentication to Entra ID via a web application always requires that you first create and register a custom OAuth application, unless you connect via Tableau. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application. For details about connecting via Tableau, see Tableau Integrated Azure, below.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections.

Desktop Applications

You can authenticate from a desktop application using either the connector's embedded OAuth application or a custom OAuth application registered in Microsoft Entra ID.

Option 1: Use the Embedded OAuth Application

This is a pre-registered application, included with the connector. It simplifies setup and eliminates the need to register your own credentials and is ideal for development environments, single-user tools, or any setup where quick and easy authentication is preferred.

Set the following connection properties:

  • AuthScheme: AzureAD.
  • InitiateOAuth:
    • GETANDREFRESH: Use for the initial login. Launches the login page and saves tokens.
    • REFRESH: Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.

When you connect, the connector opens the Microsoft Entra sign-in page in your default browser. After signing in and granting access, the connector retrieves the access and refresh tokens and saves them to the path specified by OAuthSettingsLocation.

Option 2: Use a Custom OAuth Application

If your organization requires more control, such as managing security policies, redirect URIs, or application branding, you can instead register a custom OAuth application in Microsoft Entra ID and provide its values during connection.

During the registration of your custom application, as described in Creating an Entra ID (Azure AD) Application, record the following values: client Id, client secret, and callback URL (redirect URI).

Then, set the following connection properties:

  • AuthScheme: AzureAD.
  • InitiateOAuth:
    • GETANDREFRESH: Use for the initial login. Launches the login page and saves tokens.
    • REFRESH: Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
  • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
  • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
  • CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Headless Machines

Headless environments like CI/CD pipelines, background services, or server-based integrations do not have an interactive browser. To authenticate using AzureAD, you must complete the OAuth flow on a separate device with a browser and transfer the authentication result to the headless system.

Setup option:

  • Transfer an OAuth settings file
    • Authenticate on another device, then copy the stored token file to the headless environment.

Transferring OAuth Settings

  1. On a device with a browser:
    • Connect using the instructions in the Desktop Applications section.
    • After connecting, tokens are saved to the file path in OAuthSettingsLocation. The default filename is OAuthSettings.txt.

  2. On the headless machine:
    • Copy the OAuth settings file to the machine.
    • Set the following properties:
      • AuthScheme: AzureAD.
      • InitiateOAuth: REFRESH.
      • OAuthSettingsLocation: Make sure this location grants read and write permissions to the connector to enable the automatic refreshing of the access token.
      • For custom applications:
        • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
        • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

After setup, the connector uses the stored tokens to refresh the access token automatically, no browser or manual login is required.

Azure Service Principal

Authentication as an Azure Service Principal is handled via the OAuth Client Credentials flow. It does not involve direct user authentication. Instead, credentials are created for just the application itself.

All tasks taken by the application are done without a default user context, but based on the assigned roles. The application access to the resources is controlled through the assigned roles' permissions.

For Azure Service Principal authentication, set AuthScheme to AzureServicePrincipal.

Creating an AzureAD App and an Azure Service Principal

If you will authenticate using an Azure Service Principal, you must first create and register an Azure AD application with an Azure AD tenant, as described in Creating an Entra ID (Azure AD) Application.

In the Azure portal, navigate to App registrations > API permissions. Select the Microsoft Graph permissions. There are two distinct sets of permissions: Delegated permissions and Application permissions. The permissions used during client credential authentication are under Application Permissions.

Assigning a role to the application

To access resources in your subscription, you must assign an appropriate role to the custom Azure AD application. Do the following:

  1. Use the search bar to locate the Subscriptions service.
  2. Open the Subscriptions page.
  3. Select the subscription to which to assign the application.
  4. Open Access control (IAM) and select Add > Add role assignment. The Add role assignment page opens.
  5. Assign your custom Azure AD application the Owner role.

Setting the connection properties

The connection properties you set to connect with your custom Azure AD application will vary, depending on whether you want to authenticate using a Client Secret or a Certificate.

After you connect, authentication with client credentials takes place automatically like any other connection, except that no window opens to prompt the user. Because there is no user context, there is no need for a browser popup. Connections take place and are handled internally.

Client Secret Connection Properties

Certificate Connection Properties

MSI Authentication

If you are running Microsoft Excel Online on an Azure VM and want to automatically obtain Managed Service Identity (MSI) credentials to connect, set AuthScheme to AzureMSI.

User-managed Identities

To obtain a token for a managed identity, use the OAuthClientId property to specify the managed identity's client_id.

If your VM has multiple user-assigned managed identities, you must also specify OAuthClientId.

Connecting to a Workbook

The connector exposes workbooks and worksheets from drives you specify in your Microsoft account. You can connect to a workbook by providing authentication to Excel Online and setting any of the following properties.

Controlling which drives are discovered

  • Drive: The ID of a specific drive. You can use the Drives and SharePointSites views to view all the sites and drives you have access to.
  • SharepointURL: The browser URL of a SharePoint site. The driver exposes all drives under the site.
  • OAuthClientId: If AuthScheme is set to AzureServicePrincipal, the drive associated with your OAuth application is exposed.

If none of the above are specified, access is restricted to the authenticated user's personal drive.

Controlling which workbooks and worksheets or drives are exposed

  • Workbook: The name or Id of the workbook. An authenticate user can view a list of information about the available workbooks by executing a query to the Workbooks view.
  • UseSandbox: True to connect to a workbook in a sandbox account; otherwise, leave blank.
  • BrowsableSchemas: A list of drive names to expose.
  • Tables: A list of table names to expose.

Executing SQL Against Worksheet Data

For information on how to execute data manipulation SQL against worksheets and ranges, see:

For details on how the connector models worksheets and cells as tables and columns, See Data Model.

Retrieving Data from SharePoint Excel Files

To retrieve data from Sharepoint Excel files, set the SharepointURL connection property to the URL of your Sharepoint site. For example, 
 SharepointURL=https://mysite.sharepoint.com/
The driver automatically looks up each document library you have in SharePoint and lists it as a schema. Individual Excel workbooks and worksheets are listed as tables in the format Workbook_Worksheet under their corresponding document library. This works in the same manner as listing your own personal Excel documents when SharepointURL is not set.

Next Step

See Using the Connector to create data visualizations.

Copyright (c) 2026 CData Software, Inc. - All rights reserved.
Build 26.0.9770