I have moved a customer VBR install to do config backup to a dedicated storage account, after upgrade to V12 GA
As far as I can see, I cannot enable immutability on the config backup in the VBR GUI.
Would it work okay to enable a time based immutability policy on this storage account directly in Azure, or would some part of the repository data need to be changed "during normal work", so it would start failing something ? (Even if this repository is only used for config backups.)
I'm asking before I test in my homelab, because this may have already been tested
Correct, Config backups are not immutable.
You could use a File Share Backup Job in V12 to have immutable backups of the configuration backup folder.
This would fully support Azure Blob immutability without such time based immutability configurations on Azure.