The error message angle
How to turn it on or off
First make sure that all of your users have permission sets assigned and that those sets contain the relevant resources. Don't forget to include MyAthens. If you are using local accounts you'll want to do this a day or more before.
Restrictive mode is a per-organisation setting so is set on the organisation preferences page (Preferences > Organisation).The The setting is at the bottom of the page. Once you save the page the change will take a few minutes to propagate to our authentication points. You will need to repeat this for each sub-organisation that you haveRepeat for any sub-organsaiton where you want it to apply.
The advantage of this being a per-organisation setting is that you do not need to have restrictive mode turned on (or off) for all the users across your domain - a mix is possible if that would suit you better.