A Keycloak pilot should integrate one representative application with your chosen identity flow. Test first login, session expiry, logout, password or MFA recovery, and access after a role change. Include a second application if single sign-on is part of the goal.
Identity infrastructure is a critical dependency. Verify backup and restore, admin access when an upstream provider fails, certificate rotation, and how applications behave if Keycloak is unavailable. Record who owns the identity configuration and how users will be migrated before cutover.
Akousa