Which Defender CLI binary should be used in CI/CD pipelines — `aka.ms` or the DevOps CDN endpoint?

Start with the MicrosoftDefenderCLI@2 task and the linked Defender CLI install, syntax, and CI/CD documentation, then compare the documented aka.ms binary with the cli.dfd.security.azure.com endpoint. Done means establishing whether the CDN is supported and stable, whether the binaries are separate products, and which one Azure DevOps pipelines should use.

We're integrating Defender for Cloud image scanning into our Azure DevOps pipelines. Rather than using the MicrosoftDefenderCLI@2 task (which emits ##[error] for any findings regardless of the break setting), we're invoking the CLI binary directly so we can control exit code handling and surface findings as warnings.

We've discovered there are two different CLI binaries available:

Observations

1. The CDN binary appears purpose-built for CI/CD use. It's significantly smaller (24 MB vs 126 MB), supports a configurable severity threshold (--fail-on low|medium|high|critical), and auto-detects Azure DevOps pipeline authentication via SYSTEM_ACCESSTOKEN. The URL pattern (cli.dfd.security.azure.com/public/v2/latest/) suggests it's the same binary the MicrosoftDefenderCLI@2 task downloads internally.

2. The aka.ms CLI is the documented standalone CLI. It's referenced in the official CI/CD integration guide for non-ADO platforms (GitHub Actions, Jenkins, etc.). Its --defender-break flag only exits non-zero for "critical issues" with no configurable threshold.

3. The --help outputs are completely different. The CDN binary exposes flags like --fail-on, --baseline, --severity, --suppress, --quiet, and --timeout that don't exist in the aka.ms binary, and vice versa (e.g. --defender-debug, --defender-output only in aka.ms).

4. Neither binary's scan image flags match the documented CLI reference exactly. The docs list --defender-break and --defender-output as global options, which align with the aka.ms binary but not the CDN one.

Questions

1. Is the CDN endpoint (cli.dfd.security.azure.com) a supported, stable distribution channel? Can we rely on it in production pipelines, or is it an internal implementation detail of the ADO task that could change without notice?

2. Are these intended to be two separate products, or are they converging? The feature sets (especially --fail-on vs --defender-break) suggest they may be independently developed.

3. For Azure DevOps pipelines where we need to bypass the task wrapper (to avoid ##[error] on non-critical findings), which binary is recommended?