Managed Postgres speaks PostgreSQL
Connect Azure Database for PostgreSQL to Excel, Sheets and AI
Azure Database for PostgreSQL flexible server, direct or through the built-in PgBouncer.
One connection, every surface
Where your Azure PostgreSQL data can go
Connect Azure PostgreSQL once and the same read-only connection feeds all of these — no second setup, no second copy of the data. 9 of 11 have a step-by-step guide.
Azure PostgreSQL to Excel
Microsoft Excel · Excel add-in
Pull live Azure PostgreSQL results straight into a worksheet and refresh them on demand — desktop Excel, Excel Online, Microsoft 365.
Read the PostgreSQL guideAzure PostgreSQL to Google Sheets
Sheets add-on
Run a saved Azure PostgreSQL query from the sidebar and drop the rows into the sheet. Shared collaborators can refresh it themselves.
Read the PostgreSQL guideAzure PostgreSQL MCP server
Claude, Cursor and MCP clients
Give an AI assistant read-only access to Azure PostgreSQL with the schema it needs to write correct SQL — no credentials in the chat.
Read the PostgreSQL guideAzure PostgreSQL REST API
HTTP endpoint
Publish a Azure PostgreSQL query as an authenticated JSON endpoint any application can call, with an OpenAPI 3.1 spec and ready-made Postman, Insomnia and Hoppscotch collections. No database port is opened.
Read the PostgreSQL guideAzure PostgreSQL to Airtable
Automation platform
Sync Azure PostgreSQL rows into an Airtable base on a schedule, or fetch them inside an Airtable automation script.
Read the PostgreSQL guideAzure PostgreSQL to Baserow
Automation platform
Feed a Baserow table from Azure PostgreSQL over the REST endpoint — self-hosted or Baserow cloud.
Read the PostgreSQL guideAzure PostgreSQL to SeaTable
Automation platform
Keep a SeaTable base current with Azure PostgreSQL data without exporting a file or exposing the database.
Read the PostgreSQL guideAzure PostgreSQL to Smartsheet
Automation platform
Push Azure PostgreSQL results into a Smartsheet grid so plans and reports read from the source system, not last week's export.
Read the PostgreSQL guideAzure PostgreSQL to Anvil
Anvil Works · App platform
Back an Anvil Python app with Azure PostgreSQL through the REST endpoint instead of embedding database credentials in the app.
Read the PostgreSQL guideAzure PostgreSQL to Power BI
Power Query M
Paste the generated Power Query M into the Power BI Advanced Editor and the report reads live Azure PostgreSQL results over HTTPS — no ODBC driver, no database port opened.
How Power BI works no Azure PostgreSQL walkthrough written yetAzure PostgreSQL alerts and reports
Slack · Discord · Email · Webhook
Put a Azure PostgreSQL query on a schedule and have the rows delivered to Slack, Discord, email or a signed webhook — or hold the message until a row count, threshold or percentage change crosses the line you set.
How alerts and reports work no Azure PostgreSQL walkthrough written yetHow it works
5 steps, no inbound firewall change
Install the Network Agent on a Windows or Linux VM inside the VNet. Because it only connects outward, the server can keep public access switched off and you add no inbound rule.
Paste the URI from the Azure portal under Settings then Connect. Server name, port, database and username are read straight out of it.
Pick direct or the built-in PgBouncer. Direct is port 5432 and is the default; PgBouncer is port 6432 on the same host, and the card will not let the two disagree.
Use the plain username. Flexible server dropped the user@servername form the retired single server needed, and the card rejects an @ before it becomes a confusing login failure.
Save. The schema is read through information_schema and pg_catalog, and Microsoft Excel, Google Sheets, Power BI, MCP and REST all read the database through that one connection.
Feature deep-dive
What Azure PostgreSQL gives you
PgBouncer is handled, not just tolerated
Azure's flexible server ships an opt-in PgBouncer on port 6432 of the same host, running in transaction mode. Transaction mode is the one that quietly breaks clients, so the agent changes its own behaviour when it sees that port.
- Auto-prepare is switched off. Npgsql's auto-prepare uses named prepared statements, and a named statement does not survive the backend being handed to someone else between transactions.
- The session is not reset on close, because in transaction mode the connection you are returning is not the one you will get back.
- Neither is yours to configure. Choose the pooled mode, or paste a string with 6432 in it, and the right behaviour follows.
- It does have to be turned on at the Azure end first — PgBouncer is a server parameter on the flexible server, not something that is simply there.
The two mistakes this card refuses to let you make
Both of them produce an error message that tells you nothing useful, which is why they are caught in the form instead.
- A port that disagrees with the mode. Pooled with anything but 6432, or direct on 6432, is rejected with the reason rather than passed through to a timeout.
- A username carrying an @servername suffix. That was the retired single server's format; on flexible server it produces an authentication failure that looks like a wrong password, so the card names it as a format problem instead.
- A password with leading or trailing whitespace is flagged too. It is almost always a clipboard artifact and it fails as an opaque auth error.
TLS is not left to the checkbox
The Use SSL box is on by default, but the agent does not depend on you leaving it that way.
- Every .postgres.database.azure.com host is connected to with TLS required, whatever the box says. A string that lost its ?sslmode=require in the clipboard still connects encrypted.
- This is enforcement, not a default: it is a property of the Azure preset in the agent rather than a value copied from the form.
- Certificate chain verification is not performed — the connection is encrypted, and that is the honest description of it.
-- Reads run against the flexible server exactly as written
SELECT c.name,
COUNT(o.id) AS orders,
SUM(o.amount) AS revenue
FROM public.customers AS c
JOIN public.orders AS o ON o.customer_id = c.id
WHERE o.placed_at >= now() - interval '30 days'
GROUP BY c.name
ORDER BY revenue DESC;
Shared by every database connector
True of every database connector
- Outbound only — the agent opens one encrypted connection out to Query Streams. No inbound port to forward, no VPN, no IP allowlist, nothing about your database exposed to the internet.
- Credentials stay put — the database username and password live on the machine you installed the agent on. Query Streams never receives them and cannot reach your database on its own.
- Read-only, enforced — one statement at a time, SELECT and friends only. A write is rejected on your own machine before it is ever sent to the server, rather than relying on a permission somebody remembered to set.
- Deploy as many agents as you like — one per site, region or cloud. Every data source they can see arrives in a single dropdown, so nobody has to know which agent hosts what.
What you get once a query is saved
- Share the capability, not the SQL — a colleague or an outside partner can run your query and change its filters without ever seeing the statement behind it.
- Filters from either direction — declare them yourself as @variables, or let the connector spot the literal values already sitting in your WHERE clause and offer those as dropdowns.
- Read it from anywhere — Microsoft Excel, Google Sheets, Power BI, the REST API, AI assistants over MCP, the Query Builder and Nova all read the same saved query.
- Run several at once — five saved queries into five worksheet tabs, streamed concurrently, however large the results.
- Join it to anything else you have connected — another database, a business API, or a folder of files, in one read-only statement.
Cross-source SQL
Join Azure PostgreSQL to the rest of your data
One statement can span Azure PostgreSQL and your other connections at once. Each source runs only the part it can, streams the result back, and the join happens centrally — the sources never talk to each other and nothing is copied anywhere.
3 connections · 3 agents
One statement
-- nothing copied, nothing merged, nothing scheduled
SELECT c.region, COUNT(*) AS orders, SUM(i.amount_due) AS invoiced
FROM azure_pg.public.orders1 f
JOIN erp_sql.dbo.customers2 c ON c.id = f.customer_id
JOIN billing.stripe.invoices3 i ON i.customer = c.stripe_id
GROUP BY c.region
ORDER BY invoiced DESC;
The three parts are connection, schema and table — and the connection name is whatever you called it. Illustrative columns; your tables will be your tables. Read-only applies to every piece: SELECT, WITH and EXPLAIN only, with a ceiling on how much any one source may hand over for a single query. How federated queries work
Connection details
What Azure PostgreSQL needs
- Host
- <server>.postgres.database.azure.com
- Ports
- 5432 direct, 6432 for the built-in PgBouncer — the same host either way
- Driver
- Npgsql 9.0.3, carried by the agent — nothing to install at the Azure end
- TLS
- Required, and forced by the agent for every .postgres.database.azure.com host
- Database
- postgres, unless you named it otherwise
- Username
- The plain username — no @servername suffix; the card rejects one before it reaches the server
- Pooled behaviour
- On 6432 the agent pins auto-prepare off and stops resetting the session on close, which is what transaction-mode pooling needs
- PgBouncer prerequisite
- The pgbouncer server parameter has to be enabled on the flexible server first
- Authentication
- Username and password. Microsoft Entra ID is not supported
- Default schema
- public, which is what a federated reference carries
The pooled path is the part worth understanding, because it is where most tools quietly misbehave. PgBouncer in transaction mode can hand your next statement to a different backend, which invalidates named prepared statements and makes session state meaningless. Rather than leave that to you, the agent keys off port 6432 and turns off the two things that would break — auto-prepare and session reset on close. Paste a pooled string and it simply works; there is no setting to find.
The username rule catches a real migration scar. Azure's retired single server wanted user@servername; flexible server wants the plain username, and giving it the old form fails as an authentication error rather than a format error. Being told which one you have got wrong is the difference between a five-second fix and an afternoon.
TLS is enforced rather than requested. The agent requires it for every Azure Postgres host regardless of the checkbox, so a connection string that lost its sslmode parameter somewhere still travels encrypted. What it does not do is verify the certificate chain, and the page says so rather than implying a stronger guarantee than the code makes.
For a cross-source query this is ordinary Postgres: a connection you called azure_pg is written azure_pg.public.orders, and it joins to a folder of CSVs, a SQL Server system of record or a billing API in one read-only statement.
Vendor documentation: azure.microsoft.com
FAQ
Questions about Azure Database for PostgreSQL
Which tools can read Azure Database for PostgreSQL data through Query Streams?
All of them, from one connection: Excel, Google Sheets, MCP, REST API, Airtable, Baserow, SeaTable, Smartsheet, Anvil, Power BI, scheduled alerts and reports. Connect the database once and every surface reads the same read-only connection — there is no per-tool setup and no second copy of the data.
Do I have to open a firewall port to my Azure Database for PostgreSQL database?
No. The Query Streams Network Agent runs inside your network and opens a single outbound encrypted connection. Nothing listens for inbound traffic, no VPN is required, and the database keeps its existing firewall rules.
Can Query Streams change data in Azure Database for PostgreSQL?
No. The agent enforces read-only at the point of execution — one statement at a time, SELECT and friends only. Credentials stay on the agent and are never sent to Query Streams.
What does Query Streams need to connect to Azure Database for PostgreSQL?
A reachable host, a role and its password — the agent carries the driver, so nothing is installed on the database. Host: <server>.postgres.database.azure.com. Ports: 5432 direct, 6432 for the built-in PgBouncer — the same host either way. Driver: Npgsql 9.0.3, carried by the agent — nothing to install at the Azure end. TLS: Required, and forced by the agent for every .postgres.database.azure.com host.
Can I join Azure Database for PostgreSQL to another database in the same query?
Yes — that is a federated query. One statement can reference Azure Database for PostgreSQL and your other connections at once, written as connection.schema.table. Each source runs only the part it can and streams the result back; the join happens centrally, so the sources never connect to each other and nothing is copied or scheduled. Read-only applies to every piece — SELECT, WITH and EXPLAIN only — and there is a ceiling on how much any one source may hand over for a single query. Federated queries are a plan feature; the federated queries page carries the current source and size limits.
Is connecting Azure Database for PostgreSQL different from connecting PostgreSQL?
Only the connection string. Azure Database for PostgreSQL speaks the PostgreSQL wire protocol, so filters, scheduling, sharing, the Excel and Google Sheets add-ons and the MCP server all behave identically. The Azure PostgreSQL card pre-fills the host, port and SSL settings that provider expects.
Is there a Azure PostgreSQL to Excel guide?
Yes — it is the PostgreSQL guide, and it is correct for Azure Database for PostgreSQL as written. Azure PostgreSQL speaks the PostgreSQL wire protocol, so Azure PostgreSQL to Excel, Azure PostgreSQL to Google Sheets and every other destination follow the same steps. The only Azure PostgreSQL-specific part is the connection string, and the Azure PostgreSQL card fills that in for you.
Put Azure PostgreSQL where the work happens
Install the agent, point it at your database, and pick a destination.
Read-only Outbound only Credentials stay on the agent

