Question

A company is migrating an application to Azure by deploying it onto Azure Virtual Machines (an IaaS solution). The IT security team wants to clarify which party is responsible for applying operating system security patches to the virtual machines. Under the Azure shared responsibility model, who is responsible for patching the guest operating system?

Accepted Answer

The customer is always responsible for patching the guest operating system in an IaaS deployment.

Answer

Microsoft is always responsible for patching the guest operating system in an IaaS deployment.

Answer

Responsibility is shared equally, with Microsoft applying critical patches and the customer applying all others.

Answer

Neither party is responsible; Azure automatically removes the need for OS patching entirely.