Remote Mac Onboarding Checklist for Contractors
Short-term contractors eat time when every onboarding is ad-hoc: picking the wrong account type, delivering a password over a channel that leaks it, forgetting to lock the session, and leaving a half-deleted account behind. The 18 steps below produce a scoped, named-account remote Mac session on a Figment plan, a printable record you can file with the engagement, and a clean offboarding that keeps the contractor's project data and removes their access.
Two Apple references anchor the Mac-side configuration: the user-account model in Apple's Set up users, guests and groups guide, and the sharing toggles described in Apple's Turn Mac screen sharing on or off guide. Read both before you run the checklist on a delivered machine.
Pick the Figment plan that fits the work
Match the plan to what the contractor will actually do, and to how they will reach the Mac.
| Contractor task | Suggested plan | Entry price |
|---|---|---|
| Light scripting, text-based build steps, Intel-toolchain checks | Virtual Intel macOS VM | $29/mo |
| General macOS desktop use, office apps, light design | i3 Mac (request) | from $49/mo |
| iOS/macOS development, Xcode 27, visionOS, ARM execution | M-series Mac (request) | from $95/mo |
| Managed CI with setup, backups, monitoring and 30 minutes monthly support | Managed Build Mac | $249/mo |
The $29 plan is a virtual Intel macOS environment on Linux/KVM. It runs macOS with a real graphical desktop reachable through Figment's browser console; it has no GPU acceleration, no audio, and no inbound SSH. Compatible Intel Xcode releases run on it, per Apple's porting-to-Apple-silicon guidance, which states that if you need to run Xcode on an Intel-based processor you should use Xcode 26 or earlier.
Browser-console access is tied to your Figment customer account, so it is not a per-contractor sign-in path. For a separate, auditable contractor login with their own password, request a physical plan (i3 or M-series) and confirm in the quote that per-user remote access over an approved secured channel (VPN, encrypted tunnel or vendor-provided path) is included and that the delivered Mac can host a named Standard macOS account. Do not share your Figment customer login or the browser-console URL with the contractor. Exact chip, RAM, disk and availability on i3 and M-series plans are confirmed in the quote; start one at /mac-hosting/start.
The 18-step contractor onboarding checklist
Print this page or paste the block into your ticket. Tick each box, initial it and timestamp it before filing.
Phase 1 — Pre-provisioning
[ ] 1. Record contractor full name, email, engagement start/end
dates and the project store where their output will live.
[ ] 2. Define access scope: apps, repositories and shares allowed,
and those explicitly off-limits. File the scope statement.
[ ] 3. List required tools and exact versions (for example Xcode
16.4, Node 20, Figma desktop).
[ ] 4. Choose the Figment plan from the table above.
[ ] 5. Submit the request at /mac-hosting/start. In the ticket,
specify: per-user remote access required, approved access
channel (VPN, encrypted tunnel or vendor-provided), and the
tools from step 3. Record the delivered hostname and the
confirmed access method.
Phase 2 — Account creation (run as admin on the delivered Mac)
[ ] 6. In System Settings > Users & Groups, add a Standard user for
the contractor. Apple's user guide notes a Standard user can
install apps and change their own settings, but cannot add
users or change other users' settings.
[ ] 7. Set the account password at the full length your password
manager generates; do not shorten it for a legacy VNC
client. Store it in the password manager, not in this
document.
[ ] 8. In System Settings > General > Sharing, turn on Screen
Sharing. Under "Allow access for", choose "Only these
users" and add the contractor account only. Leave Remote
Management and Remote Login off unless the quote specifies
otherwise.
[ ] 9. Confirm the approved access channel is in place end-to-end
(VPN client installed on your side, tunnel reachable, or
vendor path configured). Do not expose Screen Sharing or a
VNC port directly to the public internet.
[ ] 10. Install required tools as admin:
brew install <tool1> <tool2> ...
Record installed versions next to step 3.
Phase 3 — Pre-handoff test (simulate the contractor)
[ ] 11. From a different network (phone hotspot is fine), connect
over the approved channel using the contractor's named
account. Confirm the desktop loads and is responsive.
[ ] 12. Launch each required tool in the contractor session. Confirm
none prompts for admin credentials.
[ ] 13. Open one resource that is in scope and one that is out of
scope. Confirm the out-of-scope action is refused. Note:
a Standard user can still read files that are world-readable
by default (parts of other home folders, some logs). Move
or tighten permissions on anything sensitive before handover.
[ ] 14. End the session by locking the screen or logging the account
out (Apple menu > Lock Screen or Log Out). Simply closing
the Screen Sharing window leaves the user signed in; use
Lock Screen or Log Out to clear state.
Phase 4 — Credential delivery
[ ] 15. Send the hostname, the contractor's username and the access
channel instructions on your normal channel.
[ ] 16. Send the password through your organization's approved
secret-sharing method, in a separate message from step 15.
Never put hostname and password in the same message. Never
share your Figment customer login or the browser-console URL.
Phase 5 — Day-one confirmation
[ ] 17. The contractor confirms in writing: they signed in with the
named account over the approved channel, each required tool
opens, and the agreed scope matches. File the confirmation.
Phase 6 — Offboarding (on the engagement end date)
[ ] 18. a. Revoke access first: in System Settings > General >
Sharing, remove the contractor account from Screen
Sharing's "Allow access for" list, and change the
account password so any cached session cannot reconnect.
b. Back up and retain project data: copy anything the
contractor produced from their home folder to the
engagement's project store, following your retention
policy.
c. In System Settings > Users & Groups, delete the account.
Choose "Save the home folder as a disk image" if your
policy requires retention on the Mac, or "Delete the
home folder" if policy requires removal.
d. Rotate any other shared secrets the contractor held
(repository tokens, VPN credentials, API keys).
e. File this completed checklist with the engagement record.
A small worked cost example
A six-week contractor doing Intel-toolchain checks and light scripting fits the $29 virtual Intel macOS plan. Billing is monthly, so a six-week engagement spans two monthly periods: 2 × $29 = $58. A six-week graphical-desktop engagement on the i3 plan at entry price is 2 × $49 = $98. The $29 plan is not sold as a daily or prorated rate, so a two-week engagement still incurs one monthly charge of $29. If the contractor needs a persistent desktop they drive under their own named account from day one, specify i3 or M-series in the ticket rather than retrofit the $29 VM.
Secure handover and offboarding, in one place
Three practices keep the handover tight. First, treat the Mac itself as owner-bound: the Figment customer account and its browser console are yours, not the contractor's; the contractor's path onto the machine is a named Standard account reached over the approved secured channel agreed in the quote. Second, keep hostname, username and password in separate messages on channels your security policy already approves for secrets, and never post credentials in shared chats or plain email. Third, in offboarding, revoke access before you delete anything: disable the account's sharing permission and rotate its password, copy the contractor's project files out, then delete the account through System Settings. That order prevents an in-flight session from continuing while you tidy up, and prevents accidental loss of work the contractor produced.
Ready to run this checklist on a real machine? Request a Figment Mac at /mac-hosting/start, note the per-user remote-access requirement in the ticket, and attach the completed checklist to the engagement record.
