VNET injection is the action of adding an Azure resource that resides within the Microsoft tenant, to a subnet in a VNet under the customer tenant. This approach was taken with DMS to allow us to manage the compute on behalf of the customer, while still maintaining access to customer resources. Since the network is in customer subscription, Microsoft can't manage the VM beyond issuing Start, Stop, Delete, or Deploy commands. All other management actions needing access to the VM require a customer-initiated support request and approval.