It cannot be changed directly because, when it is built, the cli configuration that is pushed is always "tunnel-group <peer address>" etc.
You have to remove the existing peer altogether. Then build a new site-site VPN with the new peer ID and then assign all of the same policies to it.
