Your company has deployed virtual machines in Azure to host web applications. The IT security team is creating a responsibility matrix to define who is responsible for applying operating system security patches. According to the Azure shared responsibility model, who is responsible for patching the operating system on Azure virtual machines?