Security. Microsoft has extensive documentation on Windows Azure's security certifications and procedures. These include ISO 2700, SSAE 16 ISAE 3402, EU Model Clauses, and HIPAA BAA. Frankly, this is how you get big government and corporate contracts, so we would expect no less. Microsoft goes above and beyond the certifications by not only penetration testing its product but offering penetration testing to its customers with seven days advanced notice.
Who's using it? Microsoft claims many thousands of Azure customers, from students to single-developer shops to Fortune 500 companies. It also notes that some legacy apps can pose a problem -- for example, an extremely stateful application with a frozen or nonmaintained code base that would preclude the architectural changes necessary to support the PaaS frameworks and its scalable tiers, availability sets, queuing across instances, and so on.
Microsoft sent us a number of published case studies. At the moment, these are mainly schools and municipalities. They don't appear to be specific to Azure either, let alone its PaaS offering. Additional case studies are available on the Azure site, but we're using Google Chrome on Ubuntu 12.04 and the site requires Silverlight.
How did it do? Microsoft called very shortly after we signed up and offered assistance. This is great customer service and honestly belongs among the differentiators. In this era of retail Internet service, "Can I help you?" can sway a decision.
Deploying Granny to Azure showed plenty of rough edges. Azure's Eclipse plug-in didn't work; in fact, it directed us to an EXE file, which obviously wasn't going to work on Linux. The Linux SDK also did not work. On Windows, deploying the application on Azure was only partially PaaS-like. Instructions for deploying the example "Hello, world" Web application include pointing the setup wizard to the local copy of your favorite application server and JDK. The app server is then merely copied to a Windows Server 2008 VM. After that, you can fairly easily have your application use Azure's SQL Server instance.
Conclusion. If you have legacy apps not based on .Net, then Azure probably won't be your first choice. However, with that hands-on approach to both customer service and security, Microsoft could go a long way.
We honestly expected a bit more from the Linux SDK and the Eclipse plug-in. Despite the talk of interoperability and all of the tweeting from OpenAtMicrosoft, Microsoft didn't shine here. Certainly, Microsoft has the wrong messaging on PaaS lock-in for our taste. That said, if you have a mixed infrastructure of .Net, Java, Ruby, Python, and PHP and can do some tweaking but prefer not to rewrite, Azure may be the best choice.
Red Hat OpenShift