PINs and page access are controlled in Manage Staff Access.
Old master PINs from config.php still work as a backup (with full access).