diff --git a/src/app/cli/interpreter.cpp b/src/app/cli/interpreter.cpp
index a0f4e904..346cc2ea 100644
--- a/src/app/cli/interpreter.cpp
+++ b/src/app/cli/interpreter.cpp
@@ -197,7 +197,9 @@ const std::map<std::string, Interpreter::Evaluator> &Interpreter::mEvaluatorMap
 };
 
 const std::map<std::string, std::string> &Interpreter::mUsageMap = *new std::map<std::string, std::string>{
-    {"config", "config get pskc\n"
+    {"config", "config get admincode\n"
+               "config set admincode <9-digits-thread-administrator-passcode>\n"
+               "config get pskc\n"
                "config set pskc <pskc-hex-string>"},
     {"start", "start <border-agent-addr> <border-agent-port>\n"
               "start [ --nwk <network-alias-list | --dom <domain-alias>]"},
@@ -912,9 +914,15 @@ Interpreter::Value Interpreter::ProcessConfig(const Expression &aExpr)
     Value value;
 
     VerifyOrExit(aExpr.size() >= 3, value = ERROR_INVALID_ARGS(SYNTAX_FEW_ARGS));
-    VerifyOrExit(aExpr[2] == "pskc", value = ERROR_INVALID_ARGS("{} is not a valid property", aExpr[2]));
+    VerifyOrExit(aExpr[2] == "pskc" || aExpr[2] == "admincode",
+                 value = ERROR_INVALID_ARGS("{} is not a valid property", aExpr[2]));
     if (aExpr[1] == "get")
     {
+        if (aExpr[2] == "admincode")
+        {
+            ExitNow(value = mThreadAdministratorPasscode);
+        }
+
         value = mJobManager->GetDefaultConfigPSKc();
     }
     else if (aExpr[1] == "set")
@@ -922,7 +930,17 @@ Interpreter::Value Interpreter::ProcessConfig(const Expression &aExpr)
         ByteArray pskc;
 
         VerifyOrExit(aExpr.size() >= 4, value = ERROR_INVALID_ARGS(SYNTAX_FEW_ARGS));
-        SuccessOrExit(value = utils::Hex(pskc, aExpr[3]));
+        if (aExpr[2] == "admincode")
+        {
+            mThreadAdministratorPasscode = aExpr[3];
+
+            // TODO(rongli@): add len and last digit check per SPEC-1216v11
+            pskc.assign(mThreadAdministratorPasscode.begin(), mThreadAdministratorPasscode.end());
+        }
+        else
+        {
+            SuccessOrExit(value = utils::Hex(pskc, aExpr[3]));
+        }
         SuccessOrExit(value = mJobManager->UpdateDefaultConfigPSKc(pskc));
     }
     else
diff --git a/src/app/cli/interpreter.hpp b/src/app/cli/interpreter.hpp
index 2423bae7..5cd2f816 100644
--- a/src/app/cli/interpreter.hpp
+++ b/src/app/cli/interpreter.hpp
@@ -250,8 +250,9 @@ class Interpreter
     static std::string       BaAvailabilityToString(uint32_t aAvailability);
 
 private:
-    std::shared_ptr<JobManager> mJobManager = nullptr;
-    std::shared_ptr<Registry>   mRegistry   = nullptr;
+    std::shared_ptr<JobManager> mJobManager                  = nullptr;
+    std::shared_ptr<Registry>   mRegistry                    = nullptr;
+    std::string                 mThreadAdministratorPasscode = "";
 
     bool mShouldExit = false;