How do you work with a manager who is confidently wrong about basic IT infrastructure and security fundamentals? Their reasoning is often, "We did it that way years ago, so that's how we should do it now," without researching current best practices or consulting the team. We're running a hybrid Microsoft 365 environment, but concepts like Conditional Access and modern cloud administration seem unfamiliar to them. I don't want to come across as a know-it-all, but I also can't responsibly implement half-baked ideas or quietly do their job for them. What's the best way to handle this?
4 Answers
Choose your battles. Make a reasonable recommendation, document it, and then follow the direction you’re given unless it creates an immediate safety, legal, or security issue. You probably won’t reform a bad manager through repeated arguments, and constantly fighting every decision will burn you out. If the environment prevents you from doing good work, start looking for another position.
Stop framing it as a disagreement about who is right. Ask what outcome they want, then explain the risks, costs, and tradeoffs of the proposed approach versus a current alternative. Use documented research, budget numbers, incident examples, and side-by-side comparisons rather than saying that “the internet” recommends something. If they still choose the old approach, make sure the decision is theirs to own.
The long-term answer may be leaving. A manager who refuses current practices can hold back the whole team and leave you maintaining outdated systems while technology and your career move on. Protect yourself, keep your resume current, and don’t take personal responsibility for decisions you don’t control.
Put your concerns in writing in a neutral, professional way. Something like: “To confirm, you want us to implement X instead of Y, understanding that this creates these specific risks and costs?” Include your recommendation and ask for confirmation. That gives them a chance to reconsider, and if they proceed anyway, you have a clear record that you raised the issue.
Written confirmation is especially useful when the decision involves security, backups, access controls, or anything that could create compliance or outage problems later.
In my experience, facts alone rarely change a stubborn manager’s mind, but costs, timelines, risk exposure, and comparisons sometimes do.