On-premise web api secured by azure ad and called by js script hosted on sharepoint online

Current situation:

1. On-premise IIS with some asp.net core web api. IIS with windows authentication
2. SharePoint online scripts, which call our web apis from point 1.
3. We have Azure AD, synced with our on-premise AD.

User navigates to sharepoint online site -> js script on this site calls our web api -> inside our web api code we know the user, because of windows authentication in IIS.

Now, we are thinking how this should looks like, if we will move completely from on-premise AD to Azure AD.

1. Will the windows authentication still works?
2. If not, what are the options for us? We can modify the web apis code.
3. Can the user, authenticated already in sharepoint online and Azure AD, grab some token and send it to our web api? Then our web api, using this token, could then check the identity of the user who calls the api?