Setting up organization-based access to worker monitoring reports and data exports in CommCare

I have an application that several different organizations will be using to collect patient data. I need to set up data access restrictions so that web users from organization A can only export data and view worker monitoring reports from mobile users assigned to organization A. My organization hierarchy is set up so that the organization is the highest level.

Question: How do I configure a web user that can only access reports and data from the organization they are assigned to? I followed the steps listed on the Data Access and User Editing Restrictions Help Site page (below), but didn't see the "Full Organization Access" check box in the web user config page. After assigning the web user to a location, I was still able to see mobile users assigned to other organizations in my Worker Activity Report. Is there something else I need to turn on to be able to limit report and data access by organization?

https://confluence.dimagi.com/display/commcarepublic/Data+Access+and+User+Editing+Restrictions

Edit in response to Cory's answer:

I did set up the role first, but edit role options don't include 'Full Organization Access.' However, I was then able to create a web user in that role, and assign that web user to a location. But it didn't do anything to actually restrict the reports. This is why I was asking if anything needs to be activated to access the functionality, or if it requires a specific CommCare plan.