+2  A: 

It's any character except for commas (,). The only other restriction is your database encoding settings.

You can view the source for the SqlMembershipProvider.CreateUser method, and the aspnet_Membership_CreateUser stored procedure in the database to verify.

Edit, further evidence:

http://msdn.microsoft.com/en-us/library/system.web.security.sqlmembershipprovider.updateuser.aspx

[An exception is thrown if] the UserName property of user is an empty string (""), contains a comma, or is longer than 256 characters.

Greg