diff --git a/examples/common-switches.mk b/examples/common-switches.mk
index aa668a6eb..0faae029e 100644
--- a/examples/common-switches.mk
+++ b/examples/common-switches.mk
@@ -209,6 +209,10 @@ ifeq ($(DISABLE_BUILTIN_MBEDTLS),1)
 configure_OPTIONS              += --disable-builtin-mbedtls
 endif
 
+ifneq ($(BUILTIN_MBEDTLS_MANAGEMENT),)
+COMMONCFLAGS                   += -DOPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT=$(BUILTIN_MBEDTLS_MANAGEMENT)
+endif
+
 ifeq ($(DISABLE_EXECUTABLE),1)
 configure_OPTIONS              += --enable-executable=no
 endif
diff --git a/examples/platforms/nrf528xx/src/system.c b/examples/platforms/nrf528xx/src/system.c
index ede8d0cff..61c775447 100644
--- a/examples/platforms/nrf528xx/src/system.c
+++ b/examples/platforms/nrf528xx/src/system.c
@@ -45,7 +45,7 @@
 
 #include <openthread/config.h>
 
-#if !OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS && PLATFORM_OPENTHREAD_VANILLA
+#if !OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT && PLATFORM_OPENTHREAD_VANILLA
 
 #include <mbedtls/platform.h>
 #include <mbedtls/threading.h>
@@ -79,7 +79,7 @@ void otSysInit(int argc, char *argv[])
     NRF_POWER->DCDCEN = 1;
 #endif
 
-#if !OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS && PLATFORM_OPENTHREAD_VANILLA
+#if !OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT && PLATFORM_OPENTHREAD_VANILLA
     mbedtls_platform_set_calloc_free(otHeapCAlloc, otHeapFree);
     mbedtls_platform_setup(NULL);
 #endif
@@ -146,7 +146,7 @@ void otSysDeinit(void)
     nrf5LogDeinit();
 #endif
 
-#if !OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS && PLATFORM_OPENTHREAD_VANILLA
+#if !OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT && PLATFORM_OPENTHREAD_VANILLA
     mbedtls_platform_teardown(NULL);
 #endif
 }
diff --git a/src/core/config/openthread-core-default-config.h b/src/core/config/openthread-core-default-config.h
index 3accdb4a9..c55306d1c 100644
--- a/src/core/config/openthread-core-default-config.h
+++ b/src/core/config/openthread-core-default-config.h
@@ -242,6 +242,20 @@
 #define OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS 1
 #endif
 
+/**
+ * @def OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT
+ *
+ * Define as 1 to enable bultin mbedtls management.
+ *
+ * OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT determines whether to manage mbedTLS memory
+ * allocation and debug config internally.  If not configured, the default is to enable builtin
+ * management if builtin mbedtls is enabled and disable it otherwise.
+ *
+ */
+#ifndef OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT
+#define OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS
+#endif
+
 /**
  * @def OPENTHREAD_CONFIG_HEAP_INTERNAL_SIZE
  *
diff --git a/src/core/crypto/mbedtls.cpp b/src/core/crypto/mbedtls.cpp
index c8dda75f1..a83d34591 100644
--- a/src/core/crypto/mbedtls.cpp
+++ b/src/core/crypto/mbedtls.cpp
@@ -49,7 +49,7 @@
 namespace ot {
 namespace Crypto {
 
-#if !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS
+#if !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT
 
 static void *CAlloc(size_t aCount, size_t aSize)
 {
@@ -61,17 +61,17 @@ static void Free(void *aPointer)
     Instance::Get().HeapFree(aPointer);
 }
 
-#endif // !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS
+#endif // !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT
 
 MbedTls::MbedTls(void)
 {
-#if !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS
+#if !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT
 #ifdef MBEDTLS_DEBUG_C
     // mbedTLS's debug level is almost the same as OpenThread's
     mbedtls_debug_set_threshold(OPENTHREAD_CONFIG_LOG_LEVEL);
 #endif
     mbedtls_platform_set_calloc_free(CAlloc, Free);
-#endif // !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS
+#endif // !OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS_MANAGEMENT
 }
 
 otError MbedTls::MapError(int rval)