In an IaaS deployment, who is responsible for configuring a virtual machine's firewall?

In an Infrastructure-as-a-Service (IaaS) model, the cloud provider (Microsoft Azure) is responsible for the underlying infrastructure, such as networking, storage, and virtualization. However, the customer retains control and responsibility for the operating systems, applications, data, and virtual machines themselves. Therefore, configuring a virtual machine's firewall, which operates at the operating system level or as a network security group (NSG) managed by the customer, falls under the customer's purview. Azure Load Balancer and Azure Traffic Manager are Azure services that manage network traffic distribution, not VM-specific firewalls. Microsoft Azure provides the platform, but the customer configures the specifics within their deployed IaaS resources.