diff --git a/src/core/NetworkManagerUtils.c b/src/core/NetworkManagerUtils.c
index 5ac25f2aa5..a423864c45 100644
--- a/src/core/NetworkManagerUtils.c
+++ b/src/core/NetworkManagerUtils.c
@@ -338,7 +338,6 @@ nm_utils_complete_generic(NMPlatform          *platform,
     char                          *id;
     char                          *generated_ifname;
     gs_unref_hashtable GHashTable *parameters = NULL;
-    gboolean                       valid;
 
     g_return_if_fail(ifname_prefix == NULL || ifname == NULL);
 
@@ -386,8 +385,13 @@ nm_utils_complete_generic(NMPlatform          *platform,
         parameters = NULL;
     }
 
-    valid = nm_connection_normalize(connection, parameters, NULL, NULL);
-    nm_assert(valid);
+    NM_PRAGMA_WARNING_DISABLE("-Wunused-result")
+    /* We ignore the result, because the caller validates the connection.
+     * The only reason we do a normalization attempt here is
+     * NM_CONNECTION_NORMALIZE_PARAM_IP6_CONFIG_METHOD.
+     * Could we perhaps, one day, get rid of it? */
+    nm_connection_normalize(connection, parameters, NULL, NULL);
+    NM_PRAGMA_WARNING_REENABLE
 }
 
 /*****************************************************************************/
diff --git a/src/core/nm-manager.c b/src/core/nm-manager.c
index 701bed0e85..0002c86fad 100644
--- a/src/core/nm-manager.c
+++ b/src/core/nm-manager.c
@@ -6535,18 +6535,9 @@ find_device_for_activation(NMManager            *self,
                 return FALSE;
 
             device = find_device_by_iface(self, iface, connection, NULL, NULL);
-            if (!device) {
-                g_set_error_literal(error,
-                                    NM_MANAGER_ERROR,
-                                    NM_MANAGER_ERROR_UNKNOWN_DEVICE,
-                                    "Failed to find a compatible device for this connection");
-                return FALSE;
-            }
         }
     }
 
-    nm_assert(is_vpn || NM_IS_DEVICE(device));
-
     *out_device = device;
     *out_is_vpn = is_vpn;
 
@@ -6671,7 +6662,14 @@ impl_manager_activate_connection(NMDBusObject                      *obj,
     if (!subject)
         goto error;
 
-    if (!find_device_for_activation(self, sett_conn, NULL, device_path, &device, &is_vpn, &error)) {
+    if (!find_device_for_activation(self, sett_conn, NULL, device_path, &device, &is_vpn, &error))
+        goto error;
+
+    if (!device) {
+        g_set_error_literal(&error,
+                            NM_MANAGER_ERROR,
+                            NM_MANAGER_ERROR_UNKNOWN_DEVICE,
+                            "Failed to find a compatible device for this connection");
         goto error;
     }
 
@@ -6702,6 +6700,10 @@ impl_manager_activate_connection(NMDBusObject                      *obj,
     return;
 
 error:
+    if (device && nm_device_is_software(device)) {
+        if (_check_remove_dev_on_link_deleted(self, device))
+            remove_device(self, device, FALSE);
+    }
     if (sett_conn) {
         nm_audit_log_connection_op(NM_AUDIT_OP_CONN_ACTIVATE,
                                    sett_conn,
@@ -6794,6 +6796,7 @@ _add_and_activate_auth_done(NMManager                      *self,
                             const char                     *error_desc)
 {
     NMManagerPrivate *priv;
+    NMDevice         *device;
     GError           *error = NULL;
 
     if (!success) {
@@ -6806,6 +6809,12 @@ _add_and_activate_auth_done(NMManager                      *self,
                                    nm_active_connection_get_subject(active),
                                    error->message);
         g_dbus_method_invocation_take_error(invocation, error);
+
+        device = nm_active_connection_get_device(active);
+        if (device && nm_device_is_software(device)) {
+            if (_check_remove_dev_on_link_deleted(self, device))
+                remove_device(self, device, FALSE);
+        }
         return;
     }
 
@@ -6961,31 +6970,11 @@ impl_manager_add_and_activate_connection(NMDBusObject                      *obj,
         goto error;
     }
 
-    if (is_vpn) {
-        /* Try to fill the VPN's connection setting and name at least */
-        if (!nm_connection_get_setting_vpn(incompl_conn)) {
-            error = g_error_new_literal(NM_CONNECTION_ERROR,
-                                        NM_CONNECTION_ERROR_MISSING_SETTING,
-                                        "VPN connections require a 'vpn' setting");
-            g_prefix_error(&error, "%s: ", NM_SETTING_VPN_SETTING_NAME);
-            goto error;
-        }
+    conns = nm_settings_connections_array_to_connections(
+        nm_settings_get_connections(priv->settings, NULL),
+        -1);
 
-        conns = nm_settings_connections_array_to_connections(
-            nm_settings_get_connections(priv->settings, NULL),
-            -1);
-
-        nm_utils_complete_generic(priv->platform,
-                                  incompl_conn,
-                                  NM_SETTING_VPN_SETTING_NAME,
-                                  conns,
-                                  NULL,
-                                  NULL,
-                                  NULL);
-    } else {
-        conns = nm_settings_connections_array_to_connections(
-            nm_settings_get_connections(priv->settings, NULL),
-            -1);
+    if (device) {
         /* Let each device subclass complete the connection */
         if (!nm_device_complete_connection(device,
                                            incompl_conn,
@@ -6993,9 +6982,31 @@ impl_manager_add_and_activate_connection(NMDBusObject                      *obj,
                                            conns,
                                            &error))
             goto error;
-    }
+    } else {
+        nm_utils_complete_generic(priv->platform,
+                                  incompl_conn,
+                                  nm_connection_get_connection_type(incompl_conn),
+                                  conns,
+                                  NULL,
+                                  NULL,
+                                  NULL);
 
-    nm_assert(_nm_connection_verify(incompl_conn, NULL) == NM_SETTING_VERIFY_SUCCESS);
+        if (!nm_connection_verify(incompl_conn, &error))
+            goto error;
+
+        if (!is_vpn && !device) {
+            nm_assert(nm_connection_is_virtual(incompl_conn));
+
+            device = system_create_virtual_device(self, incompl_conn);
+            if (!device) {
+                g_set_error_literal(&error,
+                                    NM_MANAGER_ERROR,
+                                    NM_MANAGER_ERROR_UNKNOWN_DEVICE,
+                                    "Failed to create a device for this connection");
+                goto error;
+            }
+        }
+    }
 
     active = _new_active_connection(self,
                                     is_vpn,