Use Excel Power Query to Read SQL Server Data Safely

Excel can read SQL Server data without embedding passwords or building SQL text from worksheet cells. Power Query is the preferred workflow for most reporting workbooks.

Connect with Power Query

1. In Excel, choose Data > Get Data > From Database > From SQL Server Database.
2. Enter the approved server and, optionally, database name.
3. Prefer organizational or Windows authentication. Use an encrypted connection and follow your team’s certificate policy.
4. Select a view or table in Navigator, then choose Transform Data to filter, rename, and type columns before loading.
5. Load the result to a table, PivotTable, or the data model.

Keep the database boundary safe

• Use a read-only database principal with access only to the required views or stored procedures.
• Return only the needed rows and columns. Apply selective filters at the source where possible.
• Do not concatenate dates, account numbers, names, or other worksheet values into a SQL string.
• Do not place a database password in VBA, a cell, the connection string, or a shared workbook.
• Review Power Query’s data-source permissions before sharing the file.

Use parameters deliberately

Create a Power Query parameter for an approved filter such as a reporting date, validate its type, and pass it through a supported connector operation. For complex or security-sensitive filters, expose a stored procedure or view designed by the database team instead of letting workbook users supply arbitrary SQL.

Refresh and sharing checklist

• Confirm who can refresh the workbook and which identity the refresh uses.
• Test with a non-privileged user.
• Document the server, database, source objects, owner, and expected refresh time.
• Avoid loading sensitive data that recipients are not authorized to retain locally.
• Set reasonable command timeouts and monitor expensive queries.

The original VBA/ADO example concatenated user-entered criteria into SQL and included unsafe credential practices. It has been removed. Power Query provides a clearer, maintainable connection workflow while database views, stored procedures, and least-privilege accounts keep authorization in SQL Server.