How to Connect Microsoft Excel to OpenClaw

The Microsoft Graph API requires an Azure AD application registration to authenticate programmatic access. This is Microsoft's equivalent of creating a Google service account — the app registration gives you a client ID and secret that OpenClaw uses to request access tokens. Steps to register the app: 1. Go to portal.azure.com and sign in with your Microsoft 365 account. 2. Navigate to 'Azure Active Directory' > 'App registrations' > 'New registration'. 3. Name the app (e.g., 'OpenClaw Excel Integration'), select 'Accounts in this organizational directory only' as the supported account type, and click 'Register'. 4. On the app's overview page, copy the 'Application (client) ID' — this is your MICROSOFT_CLIENT_ID. 5. Go to 'Certificates & secrets' > 'New client secret'. Add a description, set an expiry (24 months is reasonable), and click 'Add'. Copy the secret value immediately — it is only shown once. This is your MICROSOFT_CLIENT_SECRET. 6. Go to 'API permissions' > 'Add a permission' > 'Microsoft Graph' > 'Application permissions'. Add `Files.ReadWrite.All` (for OneDrive files) or `Sites.ReadWrite.All` (for SharePoint sites). Click 'Grant admin consent' to activate the permissions. Store the client ID and secret securely — treat the client secret as a password.

1# Azure AD app registration details to note:
2# Application (client) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (MICROSOFT_CLIENT_ID)
3# Client secret value: xxxxxxxxxxxxxxxxxxxxxxxx (MICROSOFT_CLIENT_SECRET)
4# Directory (tenant) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (MICROSOFT_TENANT_ID)
5# All three are shown on the app registration Overview page in Azure Portal
6
7# Test that credentials work — get an access token:
8curl -X POST \
9  'https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token' \
10  -H 'Content-Type: application/x-www-form-urlencoded' \
11  -d 'client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=https://graph.microsoft.com/.default&grant_type=client_credentials'
12# Success: returns JSON with 'access_token' and 'expires_in'

Open `~/.openclaw/config.yaml` and add the Microsoft Excel integration under `integrations`. The three required credentials are the tenant ID, client ID, and client secret — all from the Azure AD app registration in Step 1. The `tenant_id` is your organization's Azure AD tenant identifier — found on the app registration Overview page as 'Directory (tenant) ID'. It is a UUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. The `workbook_path` field is the path to your Excel file within OneDrive or SharePoint. For personal OneDrive, the path starts with `/me/drive/root:/path/to/file.xlsx`. For SharePoint, it starts with `/sites/SITE_NAME/drive/root:/path`. You can also specify the workbook by its Drive Item ID if you know it. OpenClaw handles token acquisition and refresh automatically — the client credentials are exchanged for a short-lived access token (valid 1 hour), and OpenClaw refreshes it transparently before expiry.

1# ~/.openclaw/config.yaml
2integrations:
3  microsoft-excel:
4    tenant_id: "YOUR_TENANT_ID"           # Azure AD tenant ID
5    client_id: "YOUR_CLIENT_ID"           # MICROSOFT_CLIENT_ID
6    client_secret: "YOUR_CLIENT_SECRET"   # MICROSOFT_CLIENT_SECRET
7    # OneDrive workbook path:
8    default_workbook: "/me/drive/root:/Documents/MyWorkbook.xlsx"
9    # OR SharePoint:
10    # default_workbook: "/sites/TeamSite/drive/root:/Shared Documents/Report.xlsx"
11    default_worksheet: "Sheet1"           # default worksheet tab name
12    value_input_option: "USER_ENTERED"    # how to interpret input values
13    persist_session: true                 # keep Excel session open between ops (faster)
14    session_timeout: 300                  # seconds before session expires (default: 300)

The Microsoft Graph API references Excel workbooks by their path in OneDrive/SharePoint or by a unique Drive Item ID. Paths are human-readable but can break if the file is moved or renamed. Drive Item IDs are stable — they do not change when the file is moved. For production OpenClaw workflows, using the Drive Item ID is more reliable than using the file path. To find the item ID, you can query the Graph API with the file path (which does work) and retrieve the ID from the response. OpenClaw can then cache this ID and use it for subsequent operations. For testing and initial setup, the file path approach (configured in Step 2) is easier to work with. Once the integration is working, consider switching to the item ID for stability. The Graph API also supports accessing Excel files by their path in SharePoint document libraries. The path structure differs slightly from OneDrive personal paths — the SharePoint path includes the site and drive context.

1# Get workbook item ID by path (using Graph API access token):
2# Replace spaces in path with %20 for URL encoding
3
4# For OneDrive (personal):
5curl -X GET \
6  'https://graph.microsoft.com/v1.0/me/drive/root:/Documents/MyWorkbook.xlsx' \
7  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
8  | python3 -m json.tool | grep '"id"'
9# Returns: "id": "DRIVE-ITEM-ID-HERE"
10
11# For SharePoint:
12curl -X GET \
13  'https://graph.microsoft.com/v1.0/sites/YOUR_TENANT.sharepoint.com:/sites/TeamSite:/drive/root:/Shared%20Documents/Report.xlsx' \
14  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
15  | python3 -m json.tool | grep '"id"'
16
17# Use the item ID in config instead of path (more stable):
18# default_workbook: "item:DRIVE-ITEM-ID-HERE"

Test the full integration by reading existing worksheet data and writing a test row. The Graph API's Excel Workbook endpoints use a session-based model for multiple operations — OpenClaw creates a session, runs operations, and closes the session. For single operations, session-less API calls are also supported. The read test fetches cell values from a specified range using A1 notation. The write test appends a new row to the worksheet. After writing, open the workbook in Excel (desktop or browser) and verify the new row appears. The Graph API Excel endpoints are under `/v1.0/drives/{drive-id}/items/{item-id}/workbook/`. OpenClaw constructs these URLs automatically from the config, but understanding the structure helps when debugging API errors. Note that Graph API Excel operations require the workbook to not be open in exclusive (protected) mode. If a colleague has the workbook open and has locked it, API writes will fail until the lock is released.

1# Test reading worksheet data via Graph API:
2curl -X GET \
3  'https://graph.microsoft.com/v1.0/me/drive/root:/Documents/MyWorkbook.xlsx:/workbook/worksheets/Sheet1/range(address=%%27Sheet1%%21A1:E5%%27)/usedRange' \
4  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
5# Returns: {"values": [["Header1", "Header2", ...], ["row1col1", ...]]}
6
7# Test appending a row:
8curl -X POST \
9  'https://graph.microsoft.com/v1.0/me/drive/root:/Documents/MyWorkbook.xlsx:/workbook/worksheets/Sheet1/tables/Table1/rows/add' \
10  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
11  -H 'Content-Type: application/json' \
12  -d '{"values": [["2026-03-30", "OpenClaw test", "Integration verified", "SUCCESS"]]}'

With the connection verified, configure OpenClaw workflows that write data to Excel workbooks automatically. The workflow patterns are similar to Google Sheets but use Graph API terminology — worksheets instead of sheets, ranges and tables instead of cell notations. For enterprise reporting, the most valuable workflow is updating named ranges or structured tables in a template workbook. Named ranges let you reference specific cells by a meaningful name (e.g., `Q1_Revenue`) rather than by cell address (e.g., `B15`). OpenClaw can update named ranges directly via the Graph API, which is more robust than cell-address-based updates that break when rows are inserted. For RapidDev clients using Microsoft 365, the Excel integration is often the most requested OpenClaw integration because it connects AI-driven data collection directly to the tools their finance and operations teams already use daily. The Graph API approach handles SharePoint permissions correctly, so the same workbook access controls that apply in Excel apply to OpenClaw's access.

1# ~/.openclaw/config.yaml — Excel automation workflows
2workflows:
3  research-to-excel:
4    trigger:
5      type: task-complete
6      task_type: web-search
7    actions:
8      - type: excel-append-row
9        integration: microsoft-excel
10        workbook: "/me/drive/root:/Documents/Research Log.xlsx"
11        worksheet: "Research Log"
12        values:
13          - "{{date:YYYY-MM-DD}}"
14          - "{{time:HH:mm:ss}}"
15          - "{{trigger.query}}"
16          - "{{trigger.summary}}"
17          - "{{trigger.source_count}}"
18          - "SUCCESS"
19
20  named-range-update:
21    trigger:
22      type: schedule
23      cron: "0 9 * * MON"  # every Monday 9am
24    actions:
25      - type: excel-update-range
26        integration: microsoft-excel
27        workbook: "/sites/TeamSite/drive/root:/Shared Documents/Weekly Report.xlsx"
28        worksheet: "Summary"
29        named_range: "LastUpdated"     # update the 'LastUpdated' named range
30        value: "{{date:MMMM D, YYYY}}"
31      - type: excel-update-range
32        integration: microsoft-excel
33        worksheet: "Summary"
34        named_range: "WeeklySummary"
35        value: "{{session.weekly_summary}}"