There are many solutions in the internet that require modifying the wpa_supplicant configuration manually and similar, but this is pretty complex, hard to get right and inflexible when the configuration changes.
The "greyed out" issue is because the PIXEL desktop in Raspbian comes with its own simple network managing service that does not support more complex WiFi setups used in enterprise and university networks (especially eduroam).
There is a simple way to fix this though that I haven't found mentioned anywhere else so far: Instead of the Raspbian integrated one you use NetworkManager, which is what's used in most Desktop Linux environments.
sudo apt install network-manager network-manager-gnome
sudo systemctl disable --now dhcpcd
sudo systemctl enable --now network-manager
nm-applet # to show the tray icon without reboot
You have to disable dhcpcd because it conflicts with NetworkManager, otherwise you get a "device not ready" message instead of a list of wifi networks.
This should now show a new tray icon where you can connect to any network like eduroam.
The setup for the enterprise wifis is the same as on any desktop linux (e.g. Ubuntu). For example, for eduroam you use PEAP (Protected EAP) instead of Tunneled TLS, leave anonymous identity domain empty, get the CA certificate depending on your university or set it to "no ca required", PEAP version automatic and inner auth MSCHAPv2.
After a reboot it should auto-connect correctly.
If you do not have a Ethernet cable to install new software before setting up WiFi, you need to look up how to install the network-manager package offline or simpler connect your phone with USB and enable "USB tethering" which works without any setup.