A mayor asks for one sentence: who patches Outlook Online versus who patches the guest OS on a cloud virtual machine?
Select an answer to reveal the explanation.
Short Explanation
Short version for the mayor: Microsoft keeps Outlook Online healthy; if you rent a VM, you still own the guest OS updates. SaaS shifts app patching up; IaaS leaves the OS on your plate.
Full Explanation
Shared responsibility differs by cloud service type, and mayors need that contrast in one clear sentence. For Outlook Online delivered as SaaS, the provider patches and operates the messaging application stack while the municipality focuses on identity, licensing, retention, and acceptable use. For a cloud virtual machine delivered as IaaS, the customer still patches and hardens the guest operating system even though the provider runs the underlying host fabric. That pairing is the accurate fundamentals answer.
Reversing the duties—customers always patch Outlook Online while providers always patch every guest OS on rented VMs—fails the shared-responsibility model. Claiming nobody patches either service fails because cloud relocates some update work; it does not abolish patching. Saying Azure Virtual Desktop alone patches Outlook Online and every municipal laptop BIOS fails conceptually: AVD is desktop virtualization and does not redefine SaaS versus IaaS ownership for Outlook or citywide firmware.
Exam caveat: SaaS customers still configure access controls, retention, and eDiscovery; “Microsoft patches the app” is not “the city has zero duties.” Operational check: publish a one-page RACI for Outlook Online versus any IaaS VMs, and verify guest-OS update status appears in the city’s vulnerability and compliance reports.