diff --git a/libnm-core/nm-setting-wireless.c b/libnm-core/nm-setting-wireless.c
index b6be7d0242..9931521825 100644
--- a/libnm-core/nm-setting-wireless.c
+++ b/libnm-core/nm-setting-wireless.c
@@ -59,6 +59,7 @@ typedef struct {
 	GSList *seen_bssids;
 	gboolean hidden;
 	guint32 powersave;
+	NMSettingMacRandomization mac_address_randomization;
 } NMSettingWirelessPrivate;
 
 enum {
@@ -77,6 +78,7 @@ enum {
 	PROP_SEEN_BSSIDS,
 	PROP_HIDDEN,
 	PROP_POWERSAVE,
+	PROP_MAC_ADDRESS_RANDOMIZATION,
 
 	LAST_PROP
 };
@@ -617,6 +619,23 @@ nm_setting_wireless_get_powersave (NMSettingWireless *setting)
 	return NM_SETTING_WIRELESS_GET_PRIVATE (setting)->powersave;
 }
 
+/**
+ * nm_setting_wireless_get_mac_address_randomization:
+ * @setting: the #NMSettingWireless
+ *
+ * Returns: the #NMSettingWireless:mac-address-randomization property of the
+ * setting
+ *
+ * Since: 1.2
+ **/
+NMSettingMacRandomization
+nm_setting_wireless_get_mac_address_randomization (NMSettingWireless *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_WIRELESS (setting), 0);
+
+	return NM_SETTING_WIRELESS_GET_PRIVATE (setting)->mac_address_randomization;
+}
+
 /**
  * nm_setting_wireless_add_seen_bssid:
  * @setting: the #NMSettingWireless
@@ -935,6 +954,9 @@ set_property (GObject *object, guint prop_id,
 	case PROP_POWERSAVE:
 		priv->powersave = g_value_get_uint (value);
 		break;
+	case PROP_MAC_ADDRESS_RANDOMIZATION:
+		priv->mac_address_randomization = g_value_get_uint (value);
+		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -991,6 +1013,9 @@ get_property (GObject *object, guint prop_id,
 	case PROP_POWERSAVE:
 		g_value_set_uint (value, nm_setting_wireless_get_powersave (setting));
 		break;
+	case PROP_MAC_ADDRESS_RANDOMIZATION:
+		g_value_set_uint (value, nm_setting_wireless_get_mac_address_randomization (setting));
+		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -1362,6 +1387,24 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 		                    G_PARAM_READWRITE |
 		                    G_PARAM_STATIC_STRINGS));
 
+	/**
+	 * NMSettingWireless:mac-address-randomization:
+	 *
+	 * One of %NM_SETTING_MAC_RANDOMIZATION_DEFAULT (never randomize unless
+	 * the user has set a global default to randomize and the supplicant
+	 * supports randomization),  %NM_SETTING_MAC_RANDOMIZATION_NEVER (never
+	 * randomize the MAC address), or %NM_SETTING_MAC_RANDOMIZATION_ALWAYS
+	 * (always randomize the MAC address).
+	 *
+	 * Since: 1.2
+	 **/
+	g_object_class_install_property
+		(object_class, PROP_MAC_ADDRESS_RANDOMIZATION,
+		 g_param_spec_uint (NM_SETTING_WIRELESS_MAC_ADDRESS_RANDOMIZATION, "", "",
+		                    0, G_MAXUINT32, NM_SETTING_MAC_RANDOMIZATION_DEFAULT,
+		                    G_PARAM_READWRITE |
+		                    G_PARAM_STATIC_STRINGS));
+
 	/* Compatibility for deprecated property */
 	/* ---ifcfg-rh---
 	 * property: security
diff --git a/libnm-core/nm-setting-wireless.h b/libnm-core/nm-setting-wireless.h
index 9fdf6c1975..a4c0147f40 100644
--- a/libnm-core/nm-setting-wireless.h
+++ b/libnm-core/nm-setting-wireless.h
@@ -55,6 +55,7 @@ G_BEGIN_DECLS
 #define NM_SETTING_WIRELESS_SEEN_BSSIDS "seen-bssids"
 #define NM_SETTING_WIRELESS_HIDDEN      "hidden"
 #define NM_SETTING_WIRELESS_POWERSAVE   "powersave"
+#define NM_SETTING_WIRELESS_MAC_ADDRESS_RANDOMIZATION   "mac-address-randomization"
 
 /**
  * NM_SETTING_WIRELESS_MODE_ADHOC:
@@ -121,6 +122,9 @@ gboolean          nm_setting_wireless_get_hidden             (NMSettingWireless
 NM_AVAILABLE_IN_1_2
 guint32           nm_setting_wireless_get_powersave          (NMSettingWireless *setting);
 
+NM_AVAILABLE_IN_1_2
+NMSettingMacRandomization nm_setting_wireless_get_mac_address_randomization (NMSettingWireless *setting);
+
 gboolean          nm_setting_wireless_add_seen_bssid         (NMSettingWireless *setting,
                                                               const char *bssid);
 
diff --git a/libnm-core/nm-setting.h b/libnm-core/nm-setting.h
index 5df73663cb..7b1d87d576 100644
--- a/libnm-core/nm-setting.h
+++ b/libnm-core/nm-setting.h
@@ -131,6 +131,22 @@ typedef enum {
 } NMSettingCompareFlags;
 
 
+/**
+ * NMSettingMacRandomization:
+ * @NM_SETTING_MAC_RANDOMIZATION_DEFAULT: the default value, which unless
+ * overridden by user-controlled defaults configuration, is "never".
+ * @NM_SETTING_MAC_RANDOMIZATION_NEVER: the device's MAC address is always used.
+ * @NM_SETTING_MAC_RANDOMIZATION_ALWAYS: a random MAC address is used.
+ *
+ * Controls if and how the MAC address of a device is randomzied.
+ **/
+typedef enum {
+	NM_SETTING_MAC_RANDOMIZATION_DEFAULT = 0,
+	NM_SETTING_MAC_RANDOMIZATION_NEVER,
+	NM_SETTING_MAC_RANDOMIZATION_ALWAYS,
+} NMSettingMacRandomization;
+
+
 /**
  * NMSetting:
  *
diff --git a/libnm/libnm.ver b/libnm/libnm.ver
index c99fc81917..eff17b3dae 100644
--- a/libnm/libnm.ver
+++ b/libnm/libnm.ver
@@ -891,11 +891,13 @@ global:
 	nm_setting_ip_config_has_dns_options;
 	nm_setting_ip_config_remove_dns_option;
 	nm_setting_ip_config_remove_dns_option_by_value;
+	nm_setting_mac_randomization_get_type;
 	nm_setting_vpn_get_timeout;
 	nm_setting_wired_get_wake_on_lan;
 	nm_setting_wired_get_wake_on_lan_password;
 	nm_setting_wired_wake_on_lan_get_type;
 	nm_setting_wireless_get_powersave;
+	nm_setting_wireless_get_mac_address_randomization;
 	nm_utils_bond_mode_int_to_string;
 	nm_utils_bond_mode_string_to_int;
 	nm_utils_enum_from_str;