When you change the PIN on main CCMUser page, it is equivalent to PIN change in User > Global Directory. So this way you change the PIN in user database. When you do it, you must also change PIN under services, which require authorization via PIN. You can do so either in CCMAdmin (Subscribe/Unsubscribe Services on Device Profile Page) or in CCMUser (Configure your Cisco IP Phone Services).
The service is like client, accessing server. First, you changed the PIN on the server, then also client must use new PIN do access services.