When you're evaluating solutions make sure to look into Authentik too. For my small company needs it was much much easier to understand and setup and it's only gotten better and more featureful.
Authentik takes a little more to set up than KeyCloak, but the effort is well worth it when you go to configure TOTP. Authentik 2FA UX can be quite easy, similar to commercial products.