Set Up Remote Mac Access for a Contractor

Published November 11, 2026 • Figment editorial team

Short-term contracts call for narrow access, not a shared master key. A dedicated standard user account on a rented Mac takes about ten minutes to set up and keeps the contractor away from your admin password, Keychain secrets, and other projects. When the engagement ends, one script removes everything.

for an iOS/macOS contractor who needs the modern Xcode toolchain, request a Figment M-series Mac from $95/month and have the account scripts below ready for day one. For Intel-only tooling, light scripting, or an evaluation, the $29 virtual Intel macOS environment is reached through the Figment browser console; it runs macOS and can host compatible Intel Xcode (Xcode 26 or earlier) for cross-compilation, but it is not Apple silicon and has no GPU or audio. Physical plans are quoted against current supply, so confirm the exact M-series chip, RAM and disk in your quote.

Handing a contractor your admin login gives them every privilege on the machine: system-wide installs, access to other users' home folders, network changes, and unrestricted Keychain reads. If the contractor's laptop is compromised, so is everything on that Mac.

A standard account on a separate rental shrinks the blast radius:

No sudo by default. Standard users cannot install system-level packages or modify protected directories without admin authentication.
Isolated home folder. /Users/contractor is readable only by that user and root; your files and credentials stay private.
Revocable on demand. A single command disables the account the moment the engagement ends.
Separately auditable. macOS logs the contractor's login events separately from your own sessions.

Apple's user, guest and group guide confirms that administrators "can add and manage other users, install apps, and change settings," while standard users "can install apps and change their own settings, but can't add other users or change other users' settings." Keep contractors in the standard tier.

Create a standard user with sysadminctl

sysadminctl is the supported command-line tool for account management on macOS. Run it from an admin Terminal session on the rental Mac. Keep passwords out of shell history by letting sysadminctl prompt interactively, or pipe one from your secret manager:

# Interactive prompt (recommended): sysadminctl asks for the new password
sudo sysadminctl interactive -addUser contractor \
    -fullName "Contractor Display Name"

Confirm the account is not in the admin group before handing over access:

dseditgroup -o checkmember -m contractor admin
# Expected: contractor is NOT a member of admin

If membership unexpectedly shows up, remove it:

sudo dseditgroup -o delete -m contractor admin

Turn on Screen Sharing in System Settings › General › Sharing › Screen Sharing, change access to Only these users, and add the contractor account. Apple's Screen Sharing guide covers enabling the service and restricting who may connect.

The same change is scriptable from the admin account:

sudo dseditgroup -o edit -n /Local/Default \
    -a contractor -t user com.apple.access_screensharing

If the contractor uses a standalone VNC client rather than Apple's Screen Sharing app, open Computer Settings under the same pane and set a dedicated VNC viewers may control screen with password value — distinct from the account password.

On a Figment physical Mac rental, the connection address appears in your Figment dashboard. The $29 virtual Intel macOS is reached through the Figment browser console; inbound SSH and standalone VNC are not currently implemented there, so plan contractor access on a physical M-series or i3 plan when native VNC is required.

Provision the account with a scheduled expiry

The script below creates the account, grants Screen Sharing, and schedules an automatic disable using at/atd. Run it as admin on the rental Mac.

#!/usr/bin/env bash
# contractor-setup.sh — scoped contractor account with scheduled expiry
# Usage: sudo bash contractor-setup.sh <username> <"Full Name"> <YYYY-MM-DD>
# Example: sudo bash contractor-setup.sh jane_dev "Jane Smith" 2026-12-15
# Requires: admin session on the rental Mac; atd loaded

set -euo pipefail

USERNAME="${1:?Provide username}"
FULLNAME="${2:?Provide full name}"
EXPIRY="${3:?Provide expiry date YYYY-MM-DD}"

umask 077

# Generate a one-time initial password; deliver via a secret manager, not chat
PASS="$(openssl rand -base64 18)"

# Create standard (non-admin) user
printf '%s\n' "$PASS" | sudo sysadminctl -addUser "$USERNAME" \
    -fullName "$FULLNAME" -password -

# Belt-and-braces: never admin
if dseditgroup -o checkmember -m "$USERNAME" admin >/dev/null 2>&1; then
    sudo dseditgroup -o delete -m "$USERNAME" admin
fi

# Grant Screen Sharing access to this account only
sudo dseditgroup -o edit -n /Local/Default \
    -a "$USERNAME" -t user com.apple.access_screensharing

# Write a revocation script to a fixed admin-owned path
REVOKE="/etc/contractor-revoke-${USERNAME}.sh"
sudo tee "$REVOKE" >/dev/null <<SCRIPT
#!/bin/bash
/usr/bin/pwpolicy -u "${USERNAME}" -disableuser
/usr/sbin/dseditgroup -o delete -m "${USERNAME}" \
    -t user com.apple.access_screensharing 2>/dev/null || true
/bin/echo "\$(date): ${USERNAME} disabled" >> /var/log/contractor-revoke.log
SCRIPT
sudo chmod 700 "$REVOKE"

# Schedule revocation at 18:00 local time on the expiry date.
# Enable atd first if needed:
#   sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.atrun.plist
EXPIRY_AT="$(date -j -f '%Y-%m-%d' "$EXPIRY" '+%Y%m%d')1800"
echo "bash $REVOKE" | sudo at -t "$EXPIRY_AT" || \
    echo "NOTE: atd job not scheduled — run $REVOKE manually on $EXPIRY"

printf '\n=== Contractor access provisioned ===\n'
printf 'Username   : %s\n'              "$USERNAME"
printf 'Initial pw : %s  (rotate on first login)\n' "$PASS"
printf 'Expiry     : %s at 18:00 (rental Mac local time)\n' "$EXPIRY"
printf 'Revoke now : sudo bash %s\n'    "$REVOKE"
printf '\nDeliver the password through an end-to-end encrypted channel.\n'

Two guardrails worth emphasising: atd is not loaded by default on recent macOS, so run the launchctl load line once before scheduling; and a machine reboot between scheduling and expiry can lose the job if atd is not persistently loaded — keep the revocation script path on hand for a manual run.

Revocation checklist for the last day

Whether the scheduled job fires or you revoke early, these steps leave nothing behind:

# 1. Disable the login
sudo pwpolicy -u "$USERNAME" -disableuser

# 2. Remove Screen Sharing access
sudo dseditgroup -o delete -m "$USERNAME" \
    -t user com.apple.access_screensharing

# 3. Confirm no live session
who   # the contractor username should not appear

# 4. Delete the account and home folder
sudo sysadminctl -deleteUser "$USERNAME" -secure

Then, in System Settings › Sharing › Screen Sharing › Computer Settings, rotate or clear the VNC viewer password so an old client cannot reconnect.

Choosing the right Figment plan for a contractor

For a contractor doing iOS, macOS or Swift work against current Apple toolchains, request an M-series Mac from $95/month. Apple silicon is required to execute ARM-only binaries, run Xcode 27, and build visionOS targets; the Apple porting guide also notes that Xcode 26 or earlier is the Intel-supported line. The $49 i3 Mac and $29 virtual Intel macOS are reasonable for Intel-only builds, scripting, admin tasks, or evaluating these workflows — the i3 and physical M-series plans collect requests until supply is confirmed, so budget for a short lead time. Managed Build Mac at $249/month adds a configured M-series Mac with CI setup, backups, monitoring and 30 minutes of monthly support if you want the contractor's environment maintained for you.

Monthly billing fits short engagements cleanly. A two-week contract still pays the monthly rate — there is no published daily or pro-rated term — so treat one month as the practical minimum and plan the revocation inside that window.

Request a configuration at Figment · Start your rental