Yeah, out-of-the-box you will need to obtain a bearer token from ServiceAPI.

But since ServiceAPI is built on top of WebAPI, you can make it support other OWIN-based authentication methods.

The below code sample can be added to an initialization module.

// Make an initialization module, and decorate it with this attribute.
[ModuleDependency(typeof(EPiServer.ServiceApi.IntegrationInitialization))]

// Add this inside the Initialize method.
GlobalConfiguration.Configure(config =>
{
	config.Filters.Add(new HostAuthenticationFilter(DefaultAuthenticationTypes.ApplicationCookie));
});

DefaultAuthenticationTypes.ApplicationCookie refers to the default cookie-based ASP.Net Identity authentication. If you used another name in your Azure AD integration, use that instead.