Question

Your company migrates several on-premises applications to Azure by deploying them on Azure Virtual Machines (an IaaS solution). During a security review, the team asks who is responsible for installing operating system security patches on those virtual machines. According to the Azure shared responsibility model, who holds this responsibility?

Accepted Answer

The customer is responsible for patching the guest operating system when using IaaS virtual machines.

Answer

Microsoft is always responsible for patching the guest operating system in all Azure service types.

Answer

The responsibility is shared equally, with Microsoft applying half of the patches and the customer applying the rest.

Answer

No patching is required because Azure virtual machines are automatically immune to operating system vulnerabilities.