PostgreSQL Flexible Server: pg_duckdb not on allowlist

Question

PostgreSQL Flexible Server: pg_duckdb not on allowlist

Rens Oostenbach 40

According to this GitHub discussion, pg_duckdb was available on the PostgreSQL Flexible Server extensions for some time. During that time, I installed the extension. It is now not available anymore on the extensions allowlist, but it is installed in my server. I want to drop the extension, but get this error:

[0A000] ERROR: extension "pg_duckdb" is not allow-listed for "azure_pg_admin" users in Azure Database for PostgreSQL Hint: to learn how to allow an extension or see the list of allowed extensions, please refer to https://go.microsoft.com/fwlink/?linkid=2301063

How should I proceed in wanting to drop the extension?

Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-07-30T18:46:36.2833333+00:00
Hi @Rens Oostenbach ,

This one's expected behavior on Flexible Server an extension has to be allow-listed before CREATE, ALTER, or DROP will work on it. Since pg_duckdb got removed from azure.extensions, the DROP is blocked even though the extension is still sitting in your database.

Fix is to temporarily put it back, drop it, then remove it again:

Re-add pg_duckdb to azure.extensions. If the portal dropdown no longer shows it, use the CLI: az postgres flexible-server parameter set \ --resource-group <rg> \ --server-name <server> \ --name azure.extensions \ --value "<your_current_list>,pg_duckdb"

Connect as a member of azure_pg_admin and run: DROP EXTENSION pg_duckdb; -- add CASCADE if other objects depend on it

Set azure.extensions back to your original list. If the CLI also rejects pg_duckdb as an invalid value, share your PostgreSQL major version and region that would mean it's been pulled for your engine version and needs a backend follow-up.
Rens Oostenbach 40 Reputation points

2026-07-31T06:35:58.12+00:00

Hello @Ganesh Chelluri

Using the CLI still gives me an error:

az postgres flexible-server parameter set --resource-group <masked_rg_name> --server-name <masked_server_name> --name azure.extensions --value "PG_STAT_STATEMENTS,pg_duckdb" (NotAllowedExtension) azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: pg_duckdb Code: NotAllowedExtension Message: azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: pg_duckdb

az postgres flexible-server parameter set --resource-group <masked_rg_name> --server-name <masked_server_name> --name azure.extensions --value "PG_STAT_STATEMENTS,PG_DUCKDB" (NotAllowedExtension) azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: PG_DUCKDB Code: NotAllowedExtension Message: azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: PG_DUCKDB

The server is on version 16.14, thus major version 16, and it is located in West Europe.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Rens Oostenbach 40 Reputation points

2026-07-31T06:45:08.96+00:00

@Ganesh Chelluri

Using the CLI unfortunately failed. I have tried multiple times adding a comment with the error message, but all my comments are automatically deleted. The server is on major version 16 and located in West Europe.
Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-07-31T07:44:17.8933333+00:00

Seems like you were hitting a pattern that triggered the somewhat oversensitive spam filter on this site. I've undeleted your first post.
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-07-31T18:34:27.1633333+00:00
Hi @Rens Oostenbach ,

Thanks for confirming the version and region, that's what I needed.

That error is coming from the control plane, not from casing or permissions. pg_duckdb isn't in the allowed-values set for PG16 anymore, so azure.extensions won't take it at all. The "re-add it, drop it, remove it" approach I gave you is a dead end here - sorry for that.

You can confirm it yourself: az postgres flexible-server parameter show \ --resource-group <rg> \ --server-name <server> \ --name azure.extensions \ --query allowedValues -o tsv If pg_duckdb isn't in that list, it can't be allowlisted on this server.

So you've got two options.

Remove it yourself Check what's there first: SELECT extname, extversion FROM pg_extension WHERE extname = 'pg_duckdb'; Then dump the database and restore it into a fresh one without the extension: pg_dump -h <server>.postgres.database.azure.com -U <admin> -d <db> -Fp -f db.sql Delete the "CREATE EXTENSION pg_duckdb;" line from db.sql (and the COMMENT ON EXTENSION line if it's there). On pg_dump 17+ you can just use --exclude-extension=pg_duckdb instead. CREATE DATABASE <db>_clean; psql -d <db>_clean -f db.sql Once you've checked it over: DROP DATABASE <db>; ALTER DATABASE <db>_clean RENAME TO <db>; No allowlist involved.

Leave the database alone If dump/restore isn't practical, raise an Azure support request for this server. The PostgreSQL team can temporarily re-enable pg_duckdb on your instance so DROP EXTENSION pg_duckdb; goes through, then take it back out. That's the only way to remove it in place. Either way, worth clearing soon - an unsupported extension will block an in-place major version upgrade, so it'll come up again when you move to PG17 or 18.
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-08-02T07:41:04.8566667+00:00

Hi @Rens Oostenbach ,

Just checking in did you get a chance to try either route?

If you go the dump/restore way, one thing to watch: if anything in the database actually depends on pg_duckdb (tables using it, views, functions), pulling the CREATE EXTENSION line out will make the restore fail on those objects. Worth running this first so you know what you're dealing with:

SELECT c.relname, c.relkind FROM pg_depend d JOIN pg_extension e ON d.refobjid = e.oid JOIN pg_class c ON d.objid = c.oid WHERE e.extname = 'pg_duckdb';

If that comes back empty, the restore should be clean. Also, when you get to the swap at the end, you'll need to kick existing connections before DROP DATABASE will go through, otherwise it'll just sit there.

If dump/restore isn't worth the hassle, the support request is the simpler path the PostgreSQL team can re-enable it on your server long enough for the DROP to run and then pull it back out.

Either way let me know how it goes and I'll keep following the thread.
Rens Oostenbach 40 Reputation points

2026-08-03T07:35:35.52+00:00

Hi @Ganesh Chelluri , I'll raise a support request because the dump/restore isn't worth the hassle indeed. Will keep this thread updated if I get more information.
Rens Oostenbach 40 Reputation points

2026-08-03T07:39:45.99+00:00

@Ganesh Chelluri

Actually, this was already my attempt at the support request. I am on the Developer support plan. When I followed the steps in the porta, I got forwarded to making the post here. Is there another way I should make the request?
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-08-03T09:09:20.4033333+00:00

Hi @Rens Oostenbach ,

No, you did the right thing on the Developer plan the portal routes you back here, so this thread is your support request. There's no separate ticket for you to raise.

Since dump/restore isn't worth it for you, I'm taking this forward internally. Removing pg_duckdb needs the extension temporarily re-enabled on your server so the DROP can run, and that's an action from our side.

Could you please check the private message and respond to it.

Your answer

Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-07-30T18:46:36.2833333+00:00

Hi @Rens Oostenbach ,

This one's expected behavior on Flexible Server an extension has to be allow-listed before CREATE, ALTER, or DROP will work on it. Since pg_duckdb got removed from azure.extensions, the DROP is blocked even though the extension is still sitting in your database.

Fix is to temporarily put it back, drop it, then remove it again:

Re-add pg_duckdb to azure.extensions. If the portal dropdown no longer shows it, use the CLI: az postgres flexible-server parameter set \ --resource-group <rg> \ --server-name <server> \ --name azure.extensions \ --value "<your_current_list>,pg_duckdb"

Connect as a member of azure_pg_admin and run: DROP EXTENSION pg_duckdb; -- add CASCADE if other objects depend on it

Set azure.extensions back to your original list. If the CLI also rejects pg_duckdb as an invalid value, share your PostgreSQL major version and region that would mean it's been pulled for your engine version and needs a backend follow-up.
Rens Oostenbach 40 Reputation points

2026-07-31T06:35:58.12+00:00

Hello @Ganesh Chelluri

Using the CLI still gives me an error:

az postgres flexible-server parameter set --resource-group <masked_rg_name> --server-name <masked_server_name> --name azure.extensions --value "PG_STAT_STATEMENTS,pg_duckdb" (NotAllowedExtension) azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: pg_duckdb Code: NotAllowedExtension Message: azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: pg_duckdb

az postgres flexible-server parameter set --resource-group <masked_rg_name> --server-name <masked_server_name> --name azure.extensions --value "PG_STAT_STATEMENTS,PG_DUCKDB" (NotAllowedExtension) azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: PG_DUCKDB Code: NotAllowedExtension Message: azure.extension or shared_preload_libraries parameter(s) value(s) contains values which are not allowed: PG_DUCKDB

The server is on version 16.14, thus major version 16, and it is located in West Europe.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Rens Oostenbach 40 Reputation points

2026-07-31T06:45:08.96+00:00

@Ganesh Chelluri

Using the CLI unfortunately failed. I have tried multiple times adding a comment with the error message, but all my comments are automatically deleted. The server is on major version 16 and located in West Europe.
Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-07-31T07:44:17.8933333+00:00

Seems like you were hitting a pattern that triggered the somewhat oversensitive spam filter on this site. I've undeleted your first post.
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-07-31T18:34:27.1633333+00:00

Hi @Rens Oostenbach ,

Thanks for confirming the version and region, that's what I needed.

That error is coming from the control plane, not from casing or permissions. pg_duckdb isn't in the allowed-values set for PG16 anymore, so azure.extensions won't take it at all. The "re-add it, drop it, remove it" approach I gave you is a dead end here - sorry for that.

You can confirm it yourself: az postgres flexible-server parameter show \ --resource-group <rg> \ --server-name <server> \ --name azure.extensions \ --query allowedValues -o tsv If pg_duckdb isn't in that list, it can't be allowlisted on this server.

So you've got two options.

Remove it yourself Check what's there first: SELECT extname, extversion FROM pg_extension WHERE extname = 'pg_duckdb'; Then dump the database and restore it into a fresh one without the extension: pg_dump -h <server>.postgres.database.azure.com -U <admin> -d <db> -Fp -f db.sql Delete the "CREATE EXTENSION pg_duckdb;" line from db.sql (and the COMMENT ON EXTENSION line if it's there). On pg_dump 17+ you can just use --exclude-extension=pg_duckdb instead. CREATE DATABASE <db>_clean; psql -d <db>_clean -f db.sql Once you've checked it over: DROP DATABASE <db>; ALTER DATABASE <db>_clean RENAME TO <db>; No allowlist involved.

Leave the database alone If dump/restore isn't practical, raise an Azure support request for this server. The PostgreSQL team can temporarily re-enable pg_duckdb on your instance so DROP EXTENSION pg_duckdb; goes through, then take it back out. That's the only way to remove it in place. Either way, worth clearing soon - an unsupported extension will block an in-place major version upgrade, so it'll come up again when you move to PG17 or 18.
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-08-02T07:41:04.8566667+00:00

Hi @Rens Oostenbach ,

Just checking in did you get a chance to try either route?

If you go the dump/restore way, one thing to watch: if anything in the database actually depends on pg_duckdb (tables using it, views, functions), pulling the CREATE EXTENSION line out will make the restore fail on those objects. Worth running this first so you know what you're dealing with:

SELECT c.relname, c.relkind FROM pg_depend d JOIN pg_extension e ON d.refobjid = e.oid JOIN pg_class c ON d.objid = c.oid WHERE e.extname = 'pg_duckdb';

If that comes back empty, the restore should be clean. Also, when you get to the swap at the end, you'll need to kick existing connections before DROP DATABASE will go through, otherwise it'll just sit there.

If dump/restore isn't worth the hassle, the support request is the simpler path the PostgreSQL team can re-enable it on your server long enough for the DROP to run and then pull it back out.

Either way let me know how it goes and I'll keep following the thread.
Rens Oostenbach 40 Reputation points

2026-08-03T07:35:35.52+00:00

Hi @Ganesh Chelluri , I'll raise a support request because the dump/restore isn't worth the hassle indeed. Will keep this thread updated if I get more information.
Rens Oostenbach 40 Reputation points

2026-08-03T07:39:45.99+00:00

@Ganesh Chelluri

Actually, this was already my attempt at the support request. I am on the Developer support plan. When I followed the steps in the porta, I got forwarded to making the post here. Is there another way I should make the request?
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-08-03T09:09:20.4033333+00:00

Hi @Rens Oostenbach ,

No, you did the right thing on the Developer plan the portal routes you back here, so this thread is your support request. There's no separate ticket for you to raise.

Since dump/restore isn't worth it for you, I'm taking this forward internally. Removing pg_duckdb needs the extension temporarily re-enabled on your server so the DROP can run, and that's an action from our side.

Could you please check the private message and respond to it.