Can I route ASP.NET Core login to different Azure B2C policies?

I have a an ASP.NET Core MVC app that I'd like to use 2 different Azure B2C authentication policies based on a user property currently stored in a database. Think along the lines of different requirements for customers vs agent as an example.

I know I can bind a single policy via config, but is there a way to dynamically pick a policy at runtime?

Yes, assuming you're using Microsoft.Identity.Web then instead of your sign-in link going to /MicrosoftIdentity/Account/SignIn have it go to a custom action you create that will populate the policy name you want to use, for example /Account/SignIn:

[AllowAnonymous]
public class AccountController : Controller
{
    public IActionResult SignIn(string? policy)
    {
        var properties = new AuthenticationProperties
        {
            RedirectUri = this.Url.Content("~/"),
        };

        // in this example we're allowing the policy name to be passed in as a parameter to the action, but this would be replaced by your custom policy selection logic
        if (!string.IsNullOrWhiteSpace(policy))
        {
            properties.Items["policy"] = policy;

            // HACK: Microsoft.Identity.Web removes the policy item as part of the redirect to IdP but we need to update the token URL when using code flow, so fix that...
            properties.Items["customPolicy"] = policy;
        }

        return this.Challenge(properties, OpenIdConnectDefaults.AuthenticationScheme);
    }
}

By populating AuthenticationProperties.Items["policy"], Microsoft.Identity.Web will automatically use that policy name when redirecting to the B2C /authorize endpoint. However, if you're using the OpenID Connect code flow (and you should be), you'll need to make sure the /token endpoint also uses the correct policy.

Microsoft.Identity.Web removes the policy item after the /authorize call, so the example above also set the policy name to customPolicy so it's available when tokens need to be exchanged. Simply update your Microsoft.Identity.Web configuration in Startup.cs to also handle the OnAuthorizationCodeReceived event:

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
        .AddMicrosoftIdentityWebApp(opt =>
        {
            // other setup here...

            opt.Events.OnAuthorizationCodeReceived += ctx =>
            {
                if (ctx.Properties?.Items.TryGetValue("customPolicy", out var customPolicy) == true)
                {
                    ctx.TokenEndpointRequest.TokenEndpoint = $"{opt.Instance}/{opt.Domain}/{customPolicy}/oauth2/v2.0/token";
                }

                return Task.CompletedTask;
            };
        }/* cookie config happens here if you're overriding defaults */);

If you want this to work correctly with [Authorize] then you also need to change the default authentication scheme so it checks your cookies and update the cookie configuration to use your custom sign-in URL instead of the default Microsoft.Identity.Web one:

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
        .AddMicrosoftIdentityWebApp(opt =>
        {
            // other setup here...

            opt.Events.OnAuthorizationCodeReceived += ctx =>
            {
                if (ctx.Properties?.Items.TryGetValue("customPolicy", out var customPolicy) == true)
                {
                    ctx.TokenEndpointRequest.TokenEndpoint = $"{opt.Instance}/{opt.Domain}/{customPolicy}/oauth2/v2.0/token";
                }

                return Task.CompletedTask;
            };
        },
        opt =>
        {
            // this should be the actual URL, not just the controller and action name
            opt.LoginPath = "/Account/SignIn";
            opt.Cookie.SameSite = SameSiteMode.None;
            opt.Cookie.SecurePolicy = CookieSecurePolicy.Always;
            opt.Cookie.IsEssential = true;
        });