diff --git a/include/nm-settings-flags.h b/include/nm-settings-flags.h
index 4bf59f2f1b..57f38ea59e 100644
--- a/include/nm-settings-flags.h
+++ b/include/nm-settings-flags.h
@@ -29,6 +29,7 @@ typedef enum {
 	NM_SETTINGS_GET_SECRETS_FLAG_NONE = 0x0,
 	NM_SETTINGS_GET_SECRETS_FLAG_ALLOW_INTERACTION = 0x1,
 	NM_SETTINGS_GET_SECRETS_FLAG_REQUEST_NEW = 0x2,
+	NM_SETTINGS_GET_SECRETS_FLAG_USER_REQUESTED = 0x4,
 
 	/* Internal only to NM */
 	NM_SETTINGS_GET_SECRETS_FLAG_ONLY_SYSTEM = 0x80000000
diff --git a/introspection/nm-secret-agent.xml b/introspection/nm-secret-agent.xml
index 0a67efdc6c..81a1321b19 100644
--- a/introspection/nm-secret-agent.xml
+++ b/introspection/nm-secret-agent.xml
@@ -96,6 +96,14 @@
               invalid or wrong.  This flag implies that interaction is allowed.
             </tp:docstring>
           </tp:flag>
+          <tp:flag suffix="USER_REQUESTED" value="0x4">
+            <tp:docstring>
+              Set if the request was initiated by user-requested action via the
+              D-Bus interface, as opposed to automatically initiated by
+              NetworkManager in response to (for example) scan results or
+              carrier changes.
+            </tp:docstring>
+          </tp:flag>
         </tp:flags>
 
         <method name="CancelGetSecrets">
diff --git a/libnm-glib/nm-secret-agent.h b/libnm-glib/nm-secret-agent.h
index c367f91675..f96a39c1a3 100644
--- a/libnm-glib/nm-secret-agent.h
+++ b/libnm-glib/nm-secret-agent.h
@@ -50,13 +50,18 @@ typedef enum {
  * secrets from the user.  This flag signals that NetworkManager thinks any
  * existing secrets are invalid or wrong.  This flag implies that interaction
  * is allowed.
+ * @NM_SECRET_AGENT_GET_SECRETS_FLAG_USER_REQUESTED: set if the request was
+ * initiated by user-requested action via the D-Bus interface, as opposed to
+ * automatically initiated by NetworkManager in response to (for example) scan
+ * results or carrier changes.
  *
  * #NMSecretAgentGetSecretsFlags values modify the behavior of a GetSecrets request.
  */
 typedef enum {
 	NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE = 0x0,
 	NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION = 0x1,
-	NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW = 0x2
+	NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW = 0x2,
+	NM_SECRET_AGENT_GET_SECRETS_FLAG_USER_REQUESTED = 0x4
 } NMSecretAgentGetSecretsFlags;
 
 #define NM_TYPE_SECRET_AGENT            (nm_secret_agent_get_type ())
diff --git a/src/nm-activation-request.c b/src/nm-activation-request.c
index 0b957fd70e..1a3cb77a69 100644
--- a/src/nm-activation-request.c
+++ b/src/nm-activation-request.c
@@ -130,6 +130,9 @@ nm_act_request_get_secrets (NMActRequest *self,
 	info->callback = callback;
 	info->callback_data = callback_data;
 
+	if (priv->user_requested)
+		flags |= NM_SETTINGS_GET_SECRETS_FLAG_USER_REQUESTED;
+
 	call_id = nm_settings_connection_get_secrets (NM_SETTINGS_CONNECTION (priv->connection),
 	                                              priv->user_requested,
 	                                              priv->user_uid,
diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index 5d240c7778..ddc758c710 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -1355,7 +1355,7 @@ dbus_secrets_auth_cb (NMSettingsConnection *self,
 			                                          TRUE,
 			                                          sender_uid,
 			                                          setting_name,
-			                                          NM_SETTINGS_GET_SECRETS_FLAG_NONE,
+			                                          NM_SETTINGS_GET_SECRETS_FLAG_USER_REQUESTED,
 			                                          NULL,
 			                                          dbus_get_agent_secrets_cb,
 			                                          context,
diff --git a/src/vpn-manager/nm-vpn-connection.c b/src/vpn-manager/nm-vpn-connection.c
index d01595d017..5f64153b28 100644
--- a/src/vpn-manager/nm-vpn-connection.c
+++ b/src/vpn-manager/nm-vpn-connection.c
@@ -1454,6 +1454,9 @@ get_secrets (NMVPNConnection *self, SecretsReq secrets_idx)
 		g_assert_not_reached ();
 	}
 
+	if (priv->user_requested)
+		flags |= NM_SETTINGS_GET_SECRETS_FLAG_USER_REQUESTED;
+
 	priv->secrets_id = nm_settings_connection_get_secrets (NM_SETTINGS_CONNECTION (priv->connection),
 	                                                       filter_by_uid,
 	                                                       priv->user_uid,