Azure Fortigate Internal to Protected = NAT, or how?

[CxxGxxX]

Hi all,

We're testing out using the Azure Fortigate single instance deployment and are trying to understand how the Internal subnet and the Protected subnet are apparently mapped 1 to 1. If we have an endpoint on the Protected subnet at 10.0.0.140, then we can also talk to that device using the Internal subnet @ 10.100.0.140.  For example, if we connect to 10.0.0.140 or 10.100.0.140 from the Fortigate itself, both respond identically. I see a routing table for traffic originating in the Protected subnet which hops through the Internal subnet, but how does it work going the other direction?

I saw a post that kindof touched on this subject where it mentioned that the Azure network fabric automatically makes this connection between subnets in the vnet... but if that's the case, then our External subnet, which is in the same vnet, would also behave the same; It doesn't. My understanding was that Azure automatically routes traffic between subnets in the same vnet, but I didn't think any NAT'ing/mapping was going on. 

Appreciate any guidance here.