You can run web services in a Web Role or worker role (and be able to open ports in either); You can host Tomcat or other web servers in a Worker role. you can choose to combine a website plus services in a single role, or split them into multiple roles for different scalability needs.