Just to make sure I understand, when a user tries to login to Kronos through Okta, then Okta will instead send them to a splash page that is hosted elsewhere, correct?

Unfortunately, there's no built in functionality for this. But you still may have some options. If your users are ONLY accessing the app from the Okta dashboard, then you can just hide the Kronos app during the maintenance. This can be done by going to the "General" tab of the Kronos app and checking the box for "Do not display application icon to users". You can then create a Bookmark App with the same app label and icon, but add the URL of the splash page, then assign this to the users during the maintenance. Once maintenance is complete, undo the changes.

I see there's a "Community Created" app for "Kronos SAML" in the OIN. Is this the app you're using? If so, you're unlikely to be able to do anything within the app settings. But if you're using a custom SAML app added from the Application Integration Wizard (AIW), then you can probably just temporarily change the SSO URL to be the URL of the splash page. When a user attempts to SSO, they'll be directed to the splash page instead. However, a SAML assertion will still be sent as a query parameter to the URL of the splash page. This is still probably okay, as most webservers will just ignore unknown query parameters by default. Still, if you try this option, you may want to test that the splash page will ignore the query parameter.

Lastly, there are two other features you might want to leverage. In the "General" tab of all apps is a setting for "Application notes for end users". This will show a note for the app in the end user's dashboard, and you can use it to inform the users that maintenance will be scheduled. You can also go to Dashboard > Notifications, and then add a notification that users will receive right on their dashboard (I believe as a banner on the top). You can also leverage this to inform users of the maintenance.