If your config backup if encrypted, then it will already contain the credentials for the azure repository. In which case, the DR process would be to deploy a new VBR server in Azure (or wherever you have compute), restore the encrypted config backup (using the encryption password) and then you can start your restores to Azure.
Alternative, you can create a new VBR server in Azure, and just connect the Azure Storage account to it without restoring the config, rescan the repo to import the VM Backups into the new instance and then start restores.
Long term, if Azure is your DR Site, it’s advisable to move your VBR to always run live out of Azure, and just run a proxy on prem for the NAS storage and to perform the backups. That way in a DR event, you don’t have to start with restore VBR, you can just go immediately to restoring the VMs themselves.
Additionally, depending on your tier of licensing, if you have rights to Veeam Recovery Orchestrator (VRO) you can even use this to create runbooks for restoring the VMs into Azure. So that when it comes to DR, someone just needs to click the go button, and all the VMs are restored in the right order, with the right VM sizes, and the right network security groups.
And it will track your ability to achieve required RPOs and RTOs, as well as provide documentation on the current plans for failover.
Thanks for all that information. Regarding your comment about VRO, I believe this is with the assumption that the Veeam server is running in Azure all the time as you detailed in your initial comment?
Also this will be an SOBR, what are your thoughts on Access Tier, Hot, Cool etc? Seems like cool may be a risk with the rehydration times and also prioritisation to other tasks, so may be more advisable to go with Hot tier?