Your company runs a web application on Azure Virtual Machines. The security team asks who is responsible for ensuring the operating system is patched and up to date. According to the shared responsibility model, who has this responsibility?