Which Defender CLI binary should be used in CI/CD pipelines — `aka.ms` or the DevOps CDN endpoint?

Inizia con l'attività MicrosoftDefenderCLI@2 e con la documentazione collegata relativa a installazione, sintassi e CI/CD di Defender CLI, quindi confronta il binario documentato di aka.ms con l'endpoint cli.dfd.security.azure.com. Il lavoro è completato quando sarà stabilito se la CDN è supportata e stabile, se i binari sono prodotti separati e quale di essi dovrebbero usare le pipeline Azure DevOps.

We're integrating Defender for Cloud image scanning into our Azure DevOps pipelines. Rather than using the MicrosoftDefenderCLI@2 task (which emits ##[error] for any findings regardless of the break setting), we're invoking the CLI binary directly so we can control exit code handling and surface findings as warnings.

We've discovered there are two different CLI binaries available:

Observations

1. The CDN binary appears purpose-built for CI/CD use. It's significantly smaller (24 MB vs 126 MB), supports a configurable severity threshold (--fail-on low|medium|high|critical), and auto-detects Azure DevOps pipeline authentication via SYSTEM_ACCESSTOKEN. The URL pattern (cli.dfd.security.azure.com/public/v2/latest/) suggests it's the same binary the MicrosoftDefenderCLI@2 task downloads internally.

2. The aka.ms CLI is the documented standalone CLI. It's referenced in the official CI/CD integration guide for non-ADO platforms (GitHub Actions, Jenkins, etc.). Its --defender-break flag only exits non-zero for "critical issues" with no configurable threshold.

3. The --help outputs are completely different. The CDN binary exposes flags like --fail-on, --baseline, --severity, --suppress, --quiet, and --timeout that don't exist in the aka.ms binary, and vice versa (e.g. --defender-debug, --defender-output only in aka.ms).

4. Neither binary's scan image flags match the documented CLI reference exactly. The docs list --defender-break and --defender-output as global options, which align with the aka.ms binary but not the CDN one.

Questions

1. Is the CDN endpoint (cli.dfd.security.azure.com) a supported, stable distribution channel? Can we rely on it in production pipelines, or is it an internal implementation detail of the ADO task that could change without notice?

2. Are these intended to be two separate products, or are they converging? The feature sets (especially --fail-on vs --defender-break) suggest they may be independently developed.

3. For Azure DevOps pipelines where we need to bypass the task wrapper (to avoid ##[error] on non-critical findings), which binary is recommended?