Defender for Cloud CLI image scan fails with "Globl Router API call doesnt not indicate success ErrorCode: 404" since 2026-10-13

Summary

Since 2026-10-13 around 00:24 UTC, every container image scan with the Microsoft Defender for Cloud CLI

fails at the assessment step with HTTP 404. The same setup worked until 2026-10-12.

Error

[ assess ] Error: scanner error during unknown: failed start assessment: Globl Router API call doesnt not indicate success ErrorCode: 404

[ERROR] sdk/scanner : Scan step failed

GuardianErrorExitCodeException: mdvm completed with an Error exit code: 4. An error occurred when trying to scan the specified image.

Environment

• Defender for Cloud CLI v2.0.3334.114 (downloaded from https://aka.ms/defender-cli_linux-x64)
• container-scanner-cli (mdvm) 1.1.5
• Authentication: token-based (DevOps Ingestion integration, client ID/secret via DEFENDER_* env vars)
• Defender CSPM: On / Defender for Containers: On
• Command: defender scan image <image>.tar --defender-output result.sarif --output-formats html

What I checked

• Authentication succeeds ("MDC: Authenticated to Microsoft Defender for Cloud.") – the failure happens after indexing (75%, "Running assessment...").
• Same CLI and scanner versions as the last successful run (2026-10-12). No configuration changes on our side.
• The DevOps Ingestion integration is enabled and unchanged; the client secret is valid.
• Reproduced on both a Microsoft-hosted Azure Pipelines agent and a local WSL2 machine on a different network.
• Reproduced with a public image (nginx:1.28-alpine), so it is not image-specific.
• --defender-debug does not print the request URL, response body or request ID.
• Azure Service Health shows no related incident.

Questions

1. Is anyone else seeing this error since 2026-10-13?
2. Is there a known issue or a backend change affecting the "start assessment" (Global Router) call for token-based authentication?
3. Is there a newer CLI version or a different endpoint we should use?

A support request has also been opened. I will update this thread if I get a resolution.

Environment

• Defender for Cloud CLI v2.0.3334.114 (downloaded from https://aka.ms/defender-cli_linux-x64)
• container-scanner-cli (mdvm) 1.1.5
• Authentication: token-based (DevOps Ingestion integration, client ID/secret via DEFENDER_* env vars)
• Defender CSPM: On / Defender for Containers: On
• Command: defender scan image <image>.tar --defender-output result.sarif --output-formats html

What I checked

• Authentication succeeds ("MDC: Authenticated to Microsoft Defender for Cloud.") – the failure happens after indexing (75%, "Running assessment...").
• Same CLI and scanner versions as the last successful run (2026-10-12). No configuration changes on our side.
• The DevOps Ingestion integration is enabled and unchanged; the client secret is valid.
• Reproduced on both a Microsoft-hosted Azure Pipelines agent and a local WSL2 machine on a different network.
• Reproduced with a public image (nginx:1.28-alpine), so it is not image-specific.
• Azure Service Health shows no related incident.

Questions

1. Is anyone else seeing this error since 2026-10-13?
2. Is there a known issue or a backend change affecting the "start assessment" (Global Router) call for token-based authentication?
3. Is there a newer CLI version or a different endpoint we should use?

요약

2026-10-13 00:24 UTC 무렵부터 Microsoft Defender for Cloud CLI로 하는 모든 컨테이너 이미지 스캔이

assessment(평가) 단계에서 HTTP 404로 실패합니다. 같은 구성으로 2026-10-12까지는 정상 동작했습니다.

오류

[ assess ] Error: scanner error during unknown: failed start assessment: Globl Router API call doesnt not indicate success ErrorCode: 404

[ERROR] sdk/scanner : Scan step failed

GuardianErrorExitCodeException: mdvm completed with an Error exit code: 4. An error occurred when trying to scan the specified image.

환경

• Defender for Cloud CLI v2.0.3334.114 (https://aka.ms/defender-cli_linux-x64 에서 다운로드)
• container-scanner-cli (mdvm) 1.1.5
• 인증: 토큰 기반 (DevOps Ingestion 통합, DEFENDER_* 환경변수로 client ID/secret 전달)
• Defender CSPM: 켜짐 / Defender for Containers: 켜짐
• 명령: defender scan image <image>.tar --defender-output result.sarif --output-formats html

확인한 사항

• 인증은 성공합니다("MDC: Authenticated to Microsoft Defender for Cloud."). 실패는 인덱싱이 끝난 뒤(75%, "Running assessment...")에 발생합니다.
• 마지막으로 성공한 실행(2026-10-12)과 CLI·스캐너 버전이 같습니다. 우리 쪽 설정 변경은 없습니다.
• DevOps Ingestion 통합은 활성 상태이고 변경 이력이 없으며, client secret도 유효합니다.
• Microsoft 호스팅 Azure Pipelines 에이전트와, 다른 네트워크의 로컬 WSL2 환경 양쪽에서 재현됩니다.
• 공개 이미지(nginx:1.28-alpine)로도 재현되므로 특정 이미지의 문제가 아닙니다.
• Azure Service Health에 관련 장애 공지가 없습니다.

질문

1. 2026-10-13 이후 같은 오류를 겪는 분이 또 있나요?
2. 토큰 기반 인증에서 "start assessment"(Global Router) 호출에 영향을 주는 알려진 이슈나 백엔드 변경이 있나요?
3. 대신 써야 하는 새 CLI 버전이나 다른 엔드포인트가 있나요?