Unable to sign up new Microsoft account with plus symbol (+) in username

[mickbyrne]

What App Center service does this affect?

This issue relates to the broader Microsoft authentication service, but is of particular concern when using App Center and attempting to set up new Microsoft accounts on behalf of clients.

Describe the bug

When attempting to create a new Microsoft account, the validation rules do not allow an email address with a plus symbol (+) in the username. For example "mick+test@wemakeapps.net".

To Reproduce

Steps to reproduce the behavior:

1. Go to 'appcenter.ms'
2. Click on 'Get Started'
3. Click on 'Continue with Microsoft'
4. Click on the link in the 'No account? Create one!' text
5. In the email field, enter an email address with a plus symbol in the username, e.g. "mick+whatevs@wemakeapps.net"

As soon as the focus leaves the field, a validation message is presented that reads:

Enter the email address in the format someone@example.com.

Expected behavior

The Microsoft sign up process should allow email addresses with plus symbols in the username.

Reasoning

My first argument for why this should be the case is simply that these are valid email addresses.

The deeper argument is about why anyone would want to use an email address like this in the first place? I'm going to describe the situation from my perspective as a commercial app developer trying to use the AppCenter service...

I run an app development agency, we develop lots of apps for various clients and rely heavily on AppCenter (having previously used HockeyApp for years). Test builds are distributed through our own App Center organisation. However, when we are ready to release the production version of an app, the preference is to set up a new AppCenter organisation on behalf of the client, owned by a distinct Microsoft account, which is also set up on behalf of the client (some clients already have their own org-specific Microsoft account for this purpose, but not many). We invite our own organisation's Microsoft account as an admin, but importantly we are not the owner. We provide the credentials for this account to the client, who can then change the email address and/or password. In order to easily set up a new Microsoft account (and AppCenter organisation) on behalf of our clients, it would be most efficient to sign up using mick+clientname@wemakeapps.net, so I receive the initial verification emails.

We use this same model for various other services, but only Microsoft has this difficult requirement re emails.

Screenshots

Not applicable.

Environment:

• Not specific to a technology or device

[iageoghe]

@mickbyrne Thank you for the thorough picture. As you rightly point out, this limitation is a byproduct of our reliance on identity providers and our move away from even having our toe in that space. Running our own authentication/identity presents security challenges that would diminish our ability to focus on our core mission of delivering developer related features. I am empathetic, but am unable to change what characters these identity providers allow for when creating an identity.

[ss23]

@iageoghe Do you know the "correct" place to report this bug? I presume there is a place somewhere in the Microsoft ecosystem, but it wasn't clear to me where it should go.