perfect just tested it and works great using some parts of that article i used the custom login schema xml that sets the cookie and i then added the code to the script.js with the link to the url that hosts the MM page. I then used that custom login schema xml on my maintenance policy label it and it works really good. If the user is a member of maintenance AD group you get the MM page. If they are not a member of the maintenance AD group and a member of oktausers ) they get the normal login page and can use okta with radius