diff --git a/controllers/schools.js b/controllers/schools.js
index 07a1f9d..b694868 100644
--- a/controllers/schools.js
+++ b/controllers/schools.js
@@ -17,7 +17,7 @@ const SCHOOL_FEATURES = [
   'rocketChat',
   'videoconference',
   'messenger',
-  'studentVisibility',
+  // 'studentVisibility', // is now handled instead with env vars / permission in school combination
   'messengerSchoolRoom',
   'oauthProvisioningEnabled',
   'showOutdatedUsers',
@@ -161,55 +161,78 @@ const getCreateHandler = (service) => {
 };
 
 const getUpdateHandler = (service) => {
-  return function (req, res, next) {
-    // parse school features
-    req.body.features = [];
-    for (let feature of SCHOOL_FEATURES) {
-      let key = 'hasFeature_' + feature;
-      if (req.body[key]) {
-        req.body.features.push(feature);
+  return async function (req, res, next) {
+    try {
+      const configuration = await api(req, {version: 'v3'}).get(`/config/public`);
+
+      if (configuration.TEACHER_STUDENT_VISIBILITY__IS_CONFIGURABLE) {
+        await api(req, {version: 'v3'}).patch(`/school/${req.params.id}`, {
+          json: {
+            permissions: {
+              teacher: {
+                STUDENT_LIST: !!req.body.hasFeature_studentVisibility
+              }
+            }
+          },
+        })
       }
-    }
 
-    api(req)
-      .patch('/' + service + '/' + req.params.id, {
+      // parse school features
+      req.body.features = [];
+      for (let feature of SCHOOL_FEATURES) {
+        let key = 'hasFeature_' + feature;
+        if (req.body[key]) {
+          req.body.features.push(feature);
+        }
+      }
+
+      await api(req).patch('/' + service + '/' + req.params.id, {
         // TODO: sanitize
         json: req.body,
       })
-      .then((data) => {
-        res.redirect(req.header('Referer'));
-      })
-      .catch((err) => {
-        next(err);
-      });
+
+      res.redirect(req.header('Referer'));
+    } catch (err) {
+      next(err);
+    }
   };
 };
 
 const getDetailHandler = (service) => {
-  return function (req, res, next) {
-    api(req)
-      .get('/' + service + '/' + req.params.id)
-      .then((data) => {
-        // parse school features
-        for (let feature of SCHOOL_FEATURES) {
-          let key = 'hasFeature_' + feature;
-          if (data.features) {
-            data[key] = data.features.indexOf(feature) !== -1;
-          } else {
-            data[key] = false;
-          }
+  return async function (req, res, next) {
+    try {
+      const configuration = await api(req, { version: 'v3' }).get(`/config/public`);
+      const data = await api(req).get('/' + service + '/' + req.params.id)
+
+      // parse school features
+      for (let feature of SCHOOL_FEATURES) {
+        let key = 'hasFeature_' + feature;
+        if (data.features) {
+          data[key] = data.features.indexOf(feature) !== -1;
+        } else {
+          data[key] = false;
         }
+      }
 
-        if (data.county && data.county.name && data.county._id) {
-          data.county = data.county._id;
-        }
+      if (!configuration.TEACHER_STUDENT_VISIBILITY__IS_CONFIGURABLE) {
+        data.hasFeature_studentVisibility_disabled = true;
+      }
 
-        res.json(data);
-      })
-      .catch((err) => {
-        next(err);
-      });
-  };
+      data.hasFeature_studentVisibility = !!configuration.TEACHER_STUDENT_VISIBILITY__IS_ENABLED_BY_DEFAULT;
+
+      if (data.permissions && data.permissions.teacher && data.permissions.teacher.STUDENT_LIST !== undefined) {
+        data.hasFeature_studentVisibility = data.permissions.teacher.STUDENT_LIST;
+      }
+
+      if (data.county && data.county.name && data.county._id) {
+        data.county = data.county._id;
+      }
+
+      res.json(data);
+    } catch (err) {
+      next(err);
+    }
+  }
 };
 
 const getDeleteHandler = (service) => {
diff --git a/static/scripts/base.js b/static/scripts/base.js
index 151c917..851ab19 100644
--- a/static/scripts/base.js
+++ b/static/scripts/base.js
@@ -22,7 +22,6 @@ function updateQueryStringParameter(uri, key, value) {
 }
 
 function populateModalForm(modal, data) {
-
     var $title = modal.find('.modal-title');
     var $btnSubmit = modal.find('.btn-submit');
     var $btnClose = modal.find('.btn-close');
@@ -59,6 +58,9 @@ function populateModalForm(modal, data) {
                         } else {
                             $(this).removeAttr("checked");
                         }
+                        if (data.fields[$(this).attr('name') + "_disabled"] ){
+                            $(this).attr("disabled", true);
+                        }
                     });
                     break;
                 case "datetime-local":