The translation function only applies to the locally controlled subnets for the MX you're configuring it on;  enabling it on the VMX only allows you to translate the subnets within the Azure environment.   If you're looking to translate one/some of the subnets used at the Spokes, you configure it on the Spoke MX once and it's the translated subnet that gets known elsewhere within the AutoVPN.   You can't translate for some/all of the Spoke subnets at the Azure VMX Hub. ... View more