The correct answer is C. an IP address range . In Microsoft Defender for Cloud Apps, IP address ranges are used to identify known network locations, such as physical offices, datacenters, VPN egress addresses, and administrative networks. Microsoft states that IP address ranges let you tag, categorize, and customize how logs and alerts are displayed and investigated. Each IP range can be assigned to a preset IP category, such as Administrative , Corporate , VPN , or other categories, so events from those IP addresses are categorized automatically in the Activity log.
This directly matches the requirement: events originating from the on-premises network must be categorized automatically as Administrative . To do that, you create an IP address range for the on-premises public IP addresses and assign the range the Administrative category. Defender for Cloud Apps then uses that categorization when displaying and filtering activity log events. Microsoft also confirms that IP address category can be manually overridden by using IP address ranges.
A named location is a Microsoft Entra Conditional Access construct, not the Defender for Cloud Apps activity-log categorization mechanism. An indicator for IP addresses is used for threat indicators in security tooling, not for activity-log categorization. A critical asset classification is unrelated to IP-based event categorization.