A company migrates several on-premises applications to Azure by deploying them onto Azure Virtual Machines (an IaaS solution). During a security review, the team asks who is responsible for applying operating system security patches to those virtual machines. Under the shared responsibility model, which party is responsible?