privacyIDEA provides a bunch of cool features. We try to present them with some nice screenshots.
Users and administrators have a common login form. Using policies you may configure to require only passwords or both factors to authenticate against privacyIDEA.
New users without a token can be welcomed by privacyIDEA’s token enrollment wizard, which can reduce the enrollment to a single click.
privacyIDEA supports a broad variety of token types including several OTP mechanisms, Push-, E-Mail-, SMS- and WebAuthn tokens. Application plugins enable many different setups.
Most popular is using connecting VPN gateways via RADIUS or using Single Sign-On protocols.
Netscaler Gateway login 
Second factor (e.g. OTP value) 
User login with Keycloak 
Keycloak OTP
The administrator has a view for all tokens (authentication devices), for all users, for policies and for the audit log.
privacyIDEA is fully configurable via policies. Policies can be global or only be valid for certain users, resolvers or privacyIDEA nodes in distributed environments.
For even more flexibility, privacyIDEA features a powerful event handlers mechanism. With this administrators are able to configure event-driven actions including token modifications, user notifications, log messages and even arbitrary scripts.
A detailed audit view gives the administrator full information about all administrative actions and also all user actions. Events like authentication requests, actions in the self service portal, resetting passwords, enrolling tokens are logged. Searching for token serial numbers give the administrator a complete token life cycle view. The audit log is digitally signed, so it will be noticed, if an entry was modified or deleted.