When you expose a web service via the "Azure AppFabric Service Bus", you have multiple ways to protect that endpoint:
First of all, you can configure the service bus itself , so that only authenticated callers can send messages to your endpoint. In this case, you let Microsoft enforce your authorization policy for you.
Second, you can secure your service in an end-to-end fashion, i.e. in addition to the basic lower-level (transport) enforcement done by Microsoft for you, you can roll your own security model on top, say message-based security (WS-Security) in the case of SOAP.
Used in conjunction, Microsoft enforces that only authenticated callers dispatch messages towards your service, and inside your service you run your own security model.
With respect to confidentiality (encryption), you also have multiple layers here: The transport layer protects messages between your client and Microsoft, and between Microsoft and your service. The message layer provides end-to-end security between your client and your service, so that Microsoft only sees an encrypted SOAP body.
 Securing and Authenticating an AppFabric Service Bus Connection
 Securing The .NET Service Bus