mjcheetham
diff --git a/‎src/shared/Core.Tests/Authentication/MicrosoftAuthenticationTests.cs‎
Lines changed: 65 additions & 0 deletions b/‎src/shared/Core.Tests/Authentication/MicrosoftAuthenticationTests.cs‎
Lines changed: 65 additions & 0 deletions
diff --git a/‎src/shared/Core/Authentication/MicrosoftAuthentication.cs‎
Lines changed: 49 additions & 0 deletions b/‎src/shared/Core/Authentication/MicrosoftAuthentication.cs‎
Lines changed: 49 additions & 0 deletions
@@ -70,4 +70,69 @@ public void MicrosoftAuthentication_GetManagedIdentity_Invalid_ThrowsArgumentExc
             Assert.Throws<ArgumentException>(() => MicrosoftAuthentication.GetManagedIdentity(str));
         }
     }
+
+    public class MicrosoftAccountTests
+    {
+        [Theory]
+        // Classic Entra ID: two GUIDs
+        [InlineData("00000000-0000-0000-0000-000000000002.00000000-0000-0000-0000-000000000001")]
+        [InlineData("12345678-1234-1234-1234-123456789abc.fedcba98-7654-3210-fedc-ba9876543210")]
+        // Non-GUID object id; tenant id is still a GUID — split on LAST dot
+        [InlineData("contoso.onmicrosoft.com.00000000-0000-0000-0000-000000000001")]
+        [InlineData("b2c-policy.tenant.00000000-0000-0000-0000-000000000001")]
+        public void MicrosoftAccount_IsHomeAccountIdShape_ObjectIdAnyAndGuidTenantId_True(string value)
+        {
+            Assert.True(MicrosoftAccount.IsHomeAccountIdShape(value));
+        }
+
+        [Theory]
+        [InlineData(null)]
+        [InlineData("")]
+        [InlineData("   ")]
+        [InlineData("alice@example.com")]
+        [InlineData("alice")]                                                                  // ADFS-shape / bare word
+        [InlineData("00000000-0000-0000-0000-000000000002")]                                   // single guid, no dot
+        [InlineData("00000000-0000-0000-0000-000000000002.")]                                  // trailing dot
+        [InlineData(".00000000-0000-0000-0000-000000000001")]                                  // leading dot
+        [InlineData("00000000-0000-0000-0000-000000000002.not-a-guid")]                        // tid is not a GUID
+        [InlineData("alice@example.com.contoso")]                                              // tid is not a GUID
+        public void MicrosoftAccount_IsHomeAccountIdShape_NotEntraHomeAccountId_False(string value)
+        {
+            Assert.False(MicrosoftAccount.IsHomeAccountIdShape(value));
+        }
+
+        [Fact]
+        public void MicrosoftAccount_FromIdentifier_HomeAccountIdShape_PopulatesHomeAccountId()
+        {
+            const string id = "00000000-0000-0000-0000-000000000002.00000000-0000-0000-0000-000000000001";
+
+            MicrosoftAccount account = MicrosoftAccount.FromIdentifier(id);
+
+            Assert.Equal(id, account.HomeAccountId);
+            Assert.Null(account.UserName);
+        }
+
+        [Theory]
+        [InlineData("alice@example.com")]
+        [InlineData("alice@contoso.onmicrosoft.com")]
+        [InlineData("alice")]                                  // ambiguous → UserName
+        [InlineData("contoso")]                                // ambiguous → UserName
+        [InlineData("00000000-0000-0000-0000-000000000002")]   // single guid, not HomeAccountId-shaped
+        public void MicrosoftAccount_FromIdentifier_NonHomeAccountIdShape_PopulatesUserName(string id)
+        {
+            MicrosoftAccount account = MicrosoftAccount.FromIdentifier(id);
+
+            Assert.Null(account.HomeAccountId);
+            Assert.Equal(id, account.UserName);
+        }
+
+        [Theory]
+        [InlineData(null)]
+        [InlineData("")]
+        [InlineData("   ")]
+        public void MicrosoftAccount_FromIdentifier_NullOrWhitespace_Throws(string id)
+        {
+            Assert.ThrowsAny<ArgumentException>(() => MicrosoftAccount.FromIdentifier(id));
+        }
+    }
 }
@@ -184,6 +184,55 @@ internal static MicrosoftAccount FromMsalAccount(IAccount msalAccount)
             return new MicrosoftAccount(msalAccount.HomeAccountId.Identifier, msalAccount.Username);
         }
 
+        /// <summary>
+        /// Construct an account from a single identifier whose shape isn't known by the caller
+        /// (typically supplied by the user via URL credential-helper input, the
+        /// <c>credential.username</c> git-config key, or a command-line argument). The identifier
+        /// is structurally classified and placed in the matching slot:
+        /// <list type="bullet">
+        ///   <item><description>An MSAL <see cref="HomeAccountId"/> shape
+        ///         (<c>&lt;object-id&gt;.&lt;tenant-id-guid&gt;</c>) is placed in
+        ///         <see cref="HomeAccountId"/>.</description></item>
+        ///   <item><description>Anything else is placed in <see cref="UserName"/>. This includes
+        ///         well-formed UPNs (<c>local@domain</c>), ADFS-style HomeAccountIds (which
+        ///         carry no tenant id and are indistinguishable from a bare username), and
+        ///         unrecognised values — MSAL's UPN-fallback resolution then either
+        ///         fuzzy-matches it or rejects it.</description></item>
+        /// </list>
+        /// The heuristics never reject an input. Throws <see cref="ArgumentException"/> only when
+        /// the identifier itself is null or whitespace.
+        /// </summary>
+        public static MicrosoftAccount FromIdentifier(string identifier)
+        {
+            EnsureArgument.NotNullOrWhiteSpace(identifier, nameof(identifier));
+
+            return IsHomeAccountIdShape(identifier)
+                ? new MicrosoftAccount(homeAccountId: identifier, userName: null)
+                : new MicrosoftAccount(homeAccountId: null, userName: identifier);
+        }
+
+        /// <summary>
+        /// True when <paramref name="value"/> structurally matches an MSAL Microsoft Entra
+        /// <c>HomeAccountId</c>: an <c>&lt;object-id&gt;.&lt;tenant-id&gt;</c> pair where the
+        /// <c>tenant-id</c> suffix is a well-formed RFC 4122 GUID (a strong invariant for
+        /// Entra ID) and the <c>object-id</c> prefix is non-empty.
+        /// </summary>
+        /// <remarks>
+        /// Splits on the last <c>.</c> to mirror <c>Microsoft.Identity.Client.AccountId.ParseFromString</c>,
+        /// which permits an object id to itself contain dots in edge scenarios (B2C, some
+        /// guest accounts). Object ids are not required to be GUIDs; only the tenant id
+        /// is checked. Does not validate that the resulting pair refers to a real account,
+        /// and intentionally does not recognise the ADFS shape (single token, no dot) since
+        /// it is indistinguishable from a bare username.
+        /// </remarks>
+        public static bool IsHomeAccountIdShape(string value)
+        {
+            if (string.IsNullOrWhiteSpace(value)) return false;
+            int dot = value.LastIndexOf('.');
+            if (dot <= 0 || dot >= value.Length - 1) return false;
+            return Guid.TryParse(value.AsSpan(dot + 1), out _);
+        }
+
         public MicrosoftAccount(string homeAccountId, string userName)
         {
             UserName = userName;