After digging through the az cli documentation I finally found the full list:
https://learn.microsoft.com/en-us/rest/api/compute/virtual-machines/create-or-update#osprofile
Disallowed values: "administrator", "admin", "user", "user1", "test", "user2", "test1", "user3", "admin1", "1", "123", "a", "actuser", "adm", "admin2", "aspnet", "backup", "console", "david", "guest", "john", "owner", "root", "server", "sql", "support", "support_388945a0", "sys", "test2", "test3", "user4", "user5".