diff --git a/azurerm/helpers/validate/api_management.go b/azurerm/helpers/validate/api_management.go
index 12f444b40d4f..97addca9e483 100644
--- a/azurerm/helpers/validate/api_management.go
+++ b/azurerm/helpers/validate/api_management.go
@@ -3,6 +3,7 @@ package validate
 import (
 	"fmt"
 	"regexp"
+	"strings"
 )
 
 func ApiManagementChildName(v interface{}, k string) (warnings []string, errors []error) {
@@ -29,10 +30,11 @@ func ApiManagementServiceName(v interface{}, k string) (warnings []string, error
 func ApiManagementUserName(v interface{}, k string) (warnings []string, errors []error) {
 	value := v.(string)
 
-	// TODO: confirm this
-
+	if strings.HasPrefix(value, "-") || strings.HasSuffix(value, "-") {
+		errors = append(errors, fmt.Errorf("%q may not start or end with '-' character", k))
+	}
 	// from the portal: `The field may contain only numbers, letters, and dash (-) sign when preceded and followed by number or a letter.`
-	if matched := regexp.MustCompile(`(^[a-zA-Z0-9])([a-zA-Z0-9-]{1,78})([a-zA-Z0-9]$)`).Match([]byte(value)); !matched {
+	if matched := regexp.MustCompile(`(^([a-zA-Z0-9-]{1,80})$)`).Match([]byte(value)); !matched {
 		errors = append(errors, fmt.Errorf("%q may only contain alphanumeric characters and dashes up to 80 characters in length", k))
 	}