The fact of the matter is that the customers source code was on their environment and on their premises behind the fire wall, TFS was on their premises behind the firewall; the environments to which they wanted to deploy were on premises also behind their fire wall; but they wanted to use VSTS in the cloud for the orchestration of their release management. Microsoft was able to wire up for them; and their source code which never saw the internet. To clear your understanding, their source code lived on premises behind their firewall and their agents did too behind the fire wall. In this case, orchestrated the move with those agents when they supposed to and what they supposed to do and where they can go and get their assets from.
To ensure this happens smoothly and what happens is suddenly bill would trigger, release management in the cloud wakes up and grabs the agents which are on their premises behind their firewall and communicate to another machine on premises to grab those agents which are also behind their fire wall, and therefore movement is orchestrated across the network and the source code was never visible or touched.