Syncing yourself to Global Administrator in Azure Active Directory

This blog details a vulnerability in Azure AD Connect (password synchronization mode) where creating an on-premises account with the same proxyAddress as a cloud-only Azure AD user causes Azure AD Connect to link the accounts and overwrite the cloud account password, enabling takeover of high-privilege accounts (e.g., Global Administrators); the issue was responsibly disclosed to Microsoft and patched in November 2018.