title: Trying to understand Firebase Authentication one account per email address and trusted providers
body: <p>When one account per email address is enabled for <em>Firebase Authentication</em> in a <em>Firebase</em> project there seems to be some additional rules that apply to the authentication process. The different providers seem to be split into two categories, trusted and untrusted providers. If at any point a user signs in through a trusted provider all untrusted providers the user has signed in with before are removed from the account. Additionally a user will never be allowed to sign in with an untrusted provider ever again. Whether a provider is trusted or untrusted seems depend on whether a new account created with a provider validates that account exclusively through sending a verification email to the address the new account was created with.</p>
  
  <p>I cannot seem to find a comprehensive list as to which providers are trusted and untrusted. Through implementing the solutions into my app I have found the following:</p>
  
  <p><strong>TRUSTED PROVIDERS:</strong></p>
  
  <ul>
  <li>Apple</li>
  <li>Google</li>
  <li>Microsoft (If the email the account was created with is
  a @outlook.com or @hotmail.com)</li>
  </ul>
  
  <p><strong>UNTRUSTED PROVIDERS:</strong></p>
  
  <ul>
  <li>Facebook</li>
  <li>Microsoft (If the email the account was created with is not a @outlook.com or @hotmail.com)</li>
  </ul>
  
  <p>Is this understanding correct? Where can I find a breakdown of the rest of the providers? My app is built in <em>Unity</em> so I would be limited only to the providers <em>Firebase</em> supports in Unity. Why is <em>Microsoft</em> both a trusted and untrusted provider in different circumstances? I could really use some help here.</p>
  
  <p>My app is for <em>iOS</em> and <em>Android</em>. I wanted to exclusively use <em>Apple</em> and <em>Google</em> sign in but <em>Apple</em> sign in is unavailable to users on <em>iOS &lt; 13</em>. These <em>iOS</em> devices seem to represent about a 6th of all devices in western nations. I tried to implement <em>Google</em> and <em>Microsoft</em> sign in to get good coverage of these users but then I ran into the complication with <em>Microsoft</em> sign in being both trusted and untrusted. I don't want to over complicate my app with manual account merging, but I don't know what other providers are wholly trusted. What is the best solution here to keep things simple stupid?</p>