ApiAndAad.cs

 services.AddAuthentication(options =>
{
    // custom scheme defined in .AddPolicyScheme() below
    options.DefaultScheme = "JwtOrApiKey";
    options.DefaultChallengeScheme = "JwtOrApiKey";
})
.AddPolicyScheme("JwtOrApiKey", "JwtOrApiKey", options =>
{
    // runs on each request
    options.ForwardDefaultSelector = context =>
    {
        var authorization = context.Request.Headers.Authorization.ToString();
        if (!string.IsNullOrEmpty(authorization) && authorization.StartsWith("Bearer "))
            return JwtBearerDefaults.AuthenticationScheme;

        return ApiKeyAuthenticationOptions.ApiKeyScheme;
    };
})
.AddScheme<ApiKeyAuthenticationOptions, ApiKeyAuthenticationHandler>(ApiKeyAuthenticationOptions.ApiKeyScheme, null, null)
.AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("ApiAzureAd"));