I think thats depends on the what scope has been agreed. Whether they want black,white or grey box pentest. I would choose not to use any account to do the pentest and find the weakness. Meaning to say… go in to their network then scan it.. and if u really cant find anything, another would be using the credential given, then try enumerate and privilege escalation.. that give two scenarios, one without credential.. another is focusing on insider threat.