To answer my own question, this is because of the automatic recycling of Azure cloud service web role, which has to be disabled. The role is recycled after 20 minutes (IIS default) before the session timeout expires.
Simon Pedersen describes the issue and gives a solution on the following page:
http://wp.sjkp.dk/windows-azure-websites-and-cloud-services-slow-on-first-request/
He talks about the slow startup, but the reason my session timeout is not respected is the same. However, Pedersen's answer contains a small issue - the startup command file must be terminated with an exit code (else roles cannot start) as follows:
IF "%ComputeEmulatorRunning%" == "false" (
REM *** Prevent the IIS app pools from shutting down due to being idle.
REM %windir%\system32\inetsrv\appcmd set config -section:applicationPools -applicationPoolDefaults.processModel.idleTimeout:00:00:00
REM *** Prevent IIS app pool recycles from recycling on the default schedule of 1740 minutes (29 hours).
REM %windir%\system32\inetsrv\appcmd set config -section:applicationPools -applicationPoolDefaults.recycling.periodicRestart.time:00:00:00
)
EXIT /B 0
PS As I want to change IIS parameters only in the cloud, I added a runtime environment variable (which is verified in startup command file, see above) to the servicedefinition.csdef as follows:
<Runtime>
<Environment>
<Variable name="ComputeEmulatorRunning">
<RoleInstanceValue xpath="/RoleEnvironment/Deployment/@emulated" />
</Variable>
</Environment>
</Runtime>