Which Defender CLI binary should be used in CI/CD pipelines — `aka.ms` or the DevOps CDN endpoint?

Bắt đầu với task MicrosoftDefenderCLI@2 và tài liệu được liên kết về cài đặt, cú pháp và CI/CD của Defender CLI, sau đó so sánh binary aka.ms được ghi trong tài liệu với endpoint cli.dfd.security.azure.com. Hoàn thành nghĩa là xác định được CDN có được hỗ trợ và ổn định hay không, các binary có phải là những sản phẩm riêng biệt hay không, và Azure DevOps pipelines nên sử dụng binary nào.

We're integrating Defender for Cloud image scanning into our Azure DevOps pipelines. Rather than using the MicrosoftDefenderCLI@2 task (which emits ##[error] for any findings regardless of the break setting), we're invoking the CLI binary directly so we can control exit code handling and surface findings as warnings.

We've discovered there are two different CLI binaries available:

Observations

1. The CDN binary appears purpose-built for CI/CD use. It's significantly smaller (24 MB vs 126 MB), supports a configurable severity threshold (--fail-on low|medium|high|critical), and auto-detects Azure DevOps pipeline authentication via SYSTEM_ACCESSTOKEN. The URL pattern (cli.dfd.security.azure.com/public/v2/latest/) suggests it's the same binary the MicrosoftDefenderCLI@2 task downloads internally.

2. The aka.ms CLI is the documented standalone CLI. It's referenced in the official CI/CD integration guide for non-ADO platforms (GitHub Actions, Jenkins, etc.). Its --defender-break flag only exits non-zero for "critical issues" with no configurable threshold.

3. The --help outputs are completely different. The CDN binary exposes flags like --fail-on, --baseline, --severity, --suppress, --quiet, and --timeout that don't exist in the aka.ms binary, and vice versa (e.g. --defender-debug, --defender-output only in aka.ms).

4. Neither binary's scan image flags match the documented CLI reference exactly. The docs list --defender-break and --defender-output as global options, which align with the aka.ms binary but not the CDN one.

Questions

1. Is the CDN endpoint (cli.dfd.security.azure.com) a supported, stable distribution channel? Can we rely on it in production pipelines, or is it an internal implementation detail of the ADO task that could change without notice?

2. Are these intended to be two separate products, or are they converging? The feature sets (especially --fail-on vs --defender-break) suggest they may be independently developed.

3. For Azure DevOps pipelines where we need to bypass the task wrapper (to avoid ##[error] on non-critical findings), which binary is recommended?