Temporary Installer Access Without Sharing Logins
Give the installer a separate temporary account with only the permissions required for the agreed work. Keep the administrator login and recovery details under owner control, then disable or delete the installer account, end its active sessions and verify the system when the work is complete.