diff --git a/data/common.yaml b/data/common.yaml
index 2fbf0ff..5283c68 100644
--- a/data/common.yaml
+++ b/data/common.yaml
@@ -1 +1,4 @@
---- {}
+---
+nm::conf:
+  main: {}
+  logging: {}
diff --git a/examples/nm_conf.pp b/examples/nm_conf.pp
new file mode 100644
index 0000000..a706e94
--- /dev/null
+++ b/examples/nm_conf.pp
@@ -0,0 +1,8 @@
+class { 'nm':
+  conf => {
+    'main' => {
+      'dns'             => 'none',
+      'no-auto-default' => '*',
+    },
+  },
+}
diff --git a/manifests/init.pp b/manifests/init.pp
index a389d4b..4d63681 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,14 +1,25 @@
 # @summary
 #   Manage NetworkManager
 #
+# @param conf
+#   If a String:
+#   Verbatim content of `NetworkManager.conf`.
+#
+#   If a Hash:
+#   Hash of data to serialize to `NetworkManager.conf`.
+#
+#   See: https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html
+#
 # @param connections
 #   Hash of nm::connection resources to create
 #
 class nm (
+  Optional[Variant[String[1], Hash[String, Hash]]] $conf = undef,
   Optional[Hash[String, Hash]] $connections = undef,
 ) {
-  $conf_dir= '/etc/NetworkManager/conf.d'
-  $conn_dir = '/etc/NetworkManager/system-connections'
+  $conf_dir= '/etc/NetworkManager'
+  $conf_d_dir= "${conf_dir}/conf.d"
+  $conn_dir = "${conf_dir}/system-connections"
 
   require nm::install
   require nm::service
@@ -25,36 +36,26 @@
   }
 
   # remove any conflicting nm drop-in config files
-  # XXX NetworkManager.conf needs to be handled
-  file { $conf_dir:
+  file { $conf_d_dir:
     ensure  => 'directory',
     purge   => true,
     recurse => true,
     force   => true,
   }
 
-  file { "${conf_dir}/ignore-unknown-interfaces.conf":
-    ensure  => 'file',
-    mode    => '0644',
-    # lint:ignore:strict_indent
-    content => @("CONF"),
-      [main]
-      # do not create connections for unmanaged interfaces
-      no-auto-default=*
-      | CONF
-    # lint:endignore
+  # write NetworkManager.conf
+  $ini_config = { 'quote_char' => undef }
+
+  $_real_conf= $conf? {
+    String  => $conf,
+    Hash    => extlib::to_ini($conf, $ini_config),
+    default => undef,
   }
 
-  file { "${conf_dir}/resolv_conf.conf":
+  file { "${conf_dir}/NetworkManager.conf":
     ensure  => 'file',
     mode    => '0644',
-    # lint:ignore:strict_indent
-    content => @("CONF"),
-      [main]
-      # do not write to /etc/resolv.conf
-      dns=none
-      | CONF
-    # lint:endignore
+    content => $_real_conf,
   }
 
   # remove unmanaged .nmconnection files
diff --git a/spec/acceptance/nm_spec.rb b/spec/acceptance/nm_spec.rb
index f6db748..a607a67 100644
--- a/spec/acceptance/nm_spec.rb
+++ b/spec/acceptance/nm_spec.rb
@@ -12,9 +12,47 @@
       it { is_expected.to be_installed }
     end
 
+    describe file('/etc/NetworkManager/NetworkManager.conf') do
+      it { is_expected.to be_file }
+      it { is_expected.to be_owned_by 'root' }
+      it { is_expected.to be_grouped_into 'root' }
+      it { is_expected.to be_mode '644' } # serverspec does not like a leading 0
+
+      its(:content) do
+        is_expected.to match <<~CONTENT
+          # THIS FILE IS CONTROLLED BY PUPPET
+
+          [main]
+
+          [logging]
+        CONTENT
+      end
+    end
+
     describe service('NetworkManager') do
       it { is_expected.to be_enabled }
       it { is_expected.to be_running }
     end
   end
+
+  context 'with conf parameter' do
+    include_examples 'the example', 'nm_conf.pp'
+
+    describe file('/etc/NetworkManager/NetworkManager.conf') do
+      it { is_expected.to be_file }
+      it { is_expected.to be_owned_by 'root' }
+      it { is_expected.to be_grouped_into 'root' }
+      it { is_expected.to be_mode '644' } # serverspec does not like a leading 0
+
+      its(:content) do
+        is_expected.to match <<~CONTENT
+          # THIS FILE IS CONTROLLED BY PUPPET
+
+          [main]
+          dns=none
+          no-auto-default=*
+        CONTENT
+      end
+    end
+  end
 end
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
index e1bd008..9dd529f 100644
--- a/spec/classes/init_spec.rb
+++ b/spec/classes/init_spec.rb
@@ -30,6 +30,13 @@
           )
         end
 
+        it do
+          is_expected.to contain_file('/etc/NetworkManager/NetworkManager.conf').with(
+            ensure: 'file',
+            mode: '0644'
+          )
+        end
+
         it do
           is_expected.to contain_file('/etc/NetworkManager/system-connections').with(
             ensure: 'directory',