Oh, this is very nice.  Just the overview people will need.

A few odds and ends:

37	+Role instances are virtual machine resources.  Many instances may exist in a
38	+deployment (and hence hosted service) but if there is more than one they are
39	+intended to be running the same load balanced application via the service;
40	+they must all share the same DNS entry and open endpoints.

Calling them virtual machine "resources" seems confusingly vague.  Isn't a role instance essentially a virtual machine?

Also, is it really true that multiple VMs are meant to run the same application in a load-balanced configuration?  My understanding was that you might just as well have different components of the same application (e.g. database, application process, httpd) running on different VMs in the same service.  The wording here seems to rule that out.

Might it be more accurate to say that a hosted service exposes one application on the internet, and it may comprise multiple virtual machines for load-balancing and/or different components of the application?

Also, I wouldn't say they "must" all share the same DNS entry — they all share the same DNS entry and the same IP address, and there's no way around it.  As for endpoints, they can of course have their own port mappings on that same IP address (and possibly load-balanced shared endpoints, but I never read the documentation for that part).


42	+For this reason, if you want several separate resources, you must create a
43	+separate service, deployment and role instance for each.

"Resources" again is very vague.  If there are resources I want to share and ones I don't want to share, this sentence leaves me completely in the dark about what to do.


48	+Each service can only see as much of each other service as any public observer
49	+does.  It's possible to place them in a private network so they are
50	+effectively on a share LAN segment with no firewall.

I think these two sentences would fit together more clearly with a "However."  The second sentence is a way to escape the limitations laid out by the first, so there's a clear contrast.  It's not a case where the second sentence follows naturally on the first.


52	+In Azure this is called a "virtual network".  The virtual network must be
53	+defined before any services are created, and then supplied at service creation
54	+time.  The virtual network can be assigned any valid networking range which
55	+becomes private to all the virtual instances defined to use it.

The "before any services are created" is a bit ambiguous, to the extent that "any services" here means "any services that will use the virtual network."  How about "You can define a virtual network, and supply it when you create a service.  This will attach the service to the virtual network for the service's entire lifetime."  Some people dislike addressing the reader directly, but it beats having most of the text in passive voice.

Another thing that may puzzle the unschooled reader is "any valid network range which becomes private to all the virtual instances defined to use it."  (Where "virtual instances" should probably be "virtual machines").  It reads as if something happens to the network range.  Consider splitting this into shorter sentences, so that you don't need to find a verb to tie the parts together: "The virtual network can be assigned any valid address range.  It is entirely private to the virtual machines that are attached to it."


60	+Azure also has storage services.  This is organised into several components:

"Storage services: Azure also has storage services."  It sounds a bit obligatory, as if you had no information to convey but had to write something.  But the reader at this point may want to see some confirmation that the term means what they probably expect it to mean, even in Azure.  Maybe something like: "Azure also supports raw data storage that is not confined to a virtual machine."


69	+A container forms the next, and only, level of indirection under the account.
70	+You cannot have a container under a container.  Containers control the
71	+default privacy of files inside themselves.

Instead of "inside themselves" I'd just say "inside them."