Configure Multi-User Access on a Rented Mac

When one rental can serve two users

One Mac rental works well for two contractors whose working hours do not overlap. A content designer on 09:00–13:00 and a backend developer on 14:00–18:00 each get the full host CPU and RAM during their own window, and the shared plan cuts hosting cost roughly in half versus two separate rentals.

The pattern falls apart under simultaneous heavy load. Xcode compiling while Affinity Designer renders a large document will contend for memory and slow both sessions. If the two contractors are frequently online at the same time, buy two plans and skip this guide.

This guide applies to Figment's physical Mac rentals (i3 Mac at $49/month, M-series Mac from $95/month; the exact M-series chip, RAM, and disk are confirmed in the quote). Physical plans are request-based, so before you sign, agree on an administrator account, the macOS version, and the session access method (console or VNC) with Figment so you can create and manage additional users from day one. Request a quote at /mac-hosting.

Create two standard accounts

Apple's guide on setting up users, guests, and groups describes the three account types. Standard accounts can install apps and change their own settings but cannot modify other users or system settings, which is the correct level for a contractor.

Via System Settings:

1. Log in to the host Mac as the administrator (via Screen Sharing/VNC or the console).
2. Apple menu → System Settings → Users & Groups.
3. Click Add User… and enter your admin password when prompted.
4. Set New account to Standard.
5. Enter full name, account name (lowercase, no spaces), and a temporary password.
6. Click Create User, then repeat for the second contractor.

macOS creates /Users/<account-name>/ for each account, owned by that user.

Via terminal (useful when you are already in a remote shell on the host):

sudo sysadminctl -addUser contractor_a -fullName "Alex Chen" \
  -password "TempPass1!" -home /Users/contractor_a -shell /bin/zsh

sudo sysadminctl -addUser contractor_b -fullName "Sam Park" \
  -password "TempPass1!" -home /Users/contractor_b -shell /bin/zsh

Ask each contractor to change their password on first login: System Settings → Users & Groups → Change Password. The exact sysadminctl flag set is not individually documented on an Apple support page, so run sysadminctl -h on your installed macOS to confirm before you script this.

Enable fast user switching

Fast user switching lets contractor B start a session without logging contractor A out. Each user's processes, apps, and Screen Sharing state stay alive on the host.

In System Settings → Control Center → Fast User Switching, set the menu to show in the menu bar (or in the Control Center, depending on your macOS version). In a Screen Sharing session, contractor A simply disconnects (their session keeps running), and contractor B authenticates with their own macOS credentials from a separate Screen Sharing connection to land on their own desktop.

Verify home-folder isolation

macOS sets each home folder's permissions to 700 (owner read/write/execute only) by default, so one standard user cannot list or write inside another's home without admin escalation. Confirm this on the actual host before you trust it:

#!/bin/bash
# isolation-check.sh
# Usage: bash isolation-check.sh <other_username>
# Run once as each contractor.

set -euo pipefail

OTHER_USER="${1:-}"
if [[ -z "$OTHER_USER" ]]; then
  echo "Usage: $0 <other_username>"
  exit 1
fi

CURRENT_USER=$(id -un)
OTHER_HOME="/Users/$OTHER_USER"

echo "=== Running as $CURRENT_USER, testing $OTHER_HOME ==="

if ls "$OTHER_HOME" > /dev/null 2>&1; then
  echo "FAIL  Can list $OTHER_HOME"
else
  echo "PASS  Cannot list $OTHER_HOME"
fi

if ls "$OTHER_HOME/Desktop" > /dev/null 2>&1; then
  echo "FAIL  Can list $OTHER_HOME/Desktop"
else
  echo "PASS  Cannot list $OTHER_HOME/Desktop"
fi

TEST_FILE="$OTHER_HOME/.iso_test_$$"
if touch "$TEST_FILE" > /dev/null 2>&1; then
  echo "FAIL  Can write to $OTHER_HOME"
  rm -f "$TEST_FILE"
else
  echo "PASS  Cannot write to $OTHER_HOME"
fi

echo "=== Done ==="

Run it in each contractor's session:

1. Log in as contractor_a and run bash isolation-check.sh contractor_b.
2. Switch to contractor_b and run bash isolation-check.sh contractor_a.

Both runs should print three PASS lines. If anything shows FAIL, an admin can restore the defaults:

sudo chmod 700 /Users/contractor_a
sudo chmod 700 /Users/contractor_b

This script is a worked example to run against your host — treat the output, not the script, as your evidence of isolation.

Give each contractor their own Screen Sharing login

The single-password VNC mode (set via the Apple Remote Desktop kickstart -vncpw flag) uses one shared secret for every connection. For two contractors who need their own credentials, authenticate Screen Sharing against user accounts instead:

1. As admin: System Settings → General → Sharing → Screen Sharing.
2. Under Allow access for, choose Only these users.
3. Add contractor_a and contractor_b with the + button.
4. Leave the legacy "VNC viewers may control screen with password" option off.

Each contractor then connects with their own macOS username and password. If you need to revoke access for one of them, remove that account from the allowed list and the other contractor is unaffected.

Cost worksheet: shared vs separate plans

Based on Figment's approved monthly offers (M-series entry at $95/month; exact chip, RAM, and disk confirmed in the quote):

The shared-plan saving over two individual rentals is roughly $95/month, or about $1,140/year, assuming both plans are the same M-series tier. Entry pricing tells you the lower bound; the actual difference depends on the chip and RAM you quote for each plan, so confirm the configuration before committing. If the two contractors' working hours overlap in practice, run a real simultaneous workload (an Xcode build alongside a design render, for example) on the host before relying on the shared arrangement.

When the team grows past two users or needs real parallel CI, the Managed Mac Team plan is the sensible next step: two M-series Macs, two CI runners, team setup, backups, monitoring, and one hour of monthly support.

A Figment i3 Mac at $49/month or M-series from $95/month handles the two-account pattern above once the administrator account and access method are agreed. Request your plan at /mac-hosting/start.

Related guides:

• Remote Mac desktop keyboard shortcuts
• Remote Mac support technician access
• Self-hosted GitHub Actions runner on Mac