The login and password expected for AA/SA access is that of the NT account, not your Unity phone password.
If Unity were in the domain you were authenticating with when you logged in you wouldn't even be prompted for a login/PW pair. Unity uses NTLM which means we get the cretentials from NT via IIS when you hit our web page and we use those to look you up - if IIS sees that you're not from a trusted domain it'll "challange and response" you and you need to provide the NT login and password here so it can pass us your credentials which we'll use to find you in our database.
By changing your NT password to match the phone password (not a good idea) you got in, but not for the reasons you might be assuming.
If you're coming from another domain for whatever reason (really, really, really strongly suggest you deploy Unity in the domain you're users are in if you can do it - it complicates things greatly when folks stuff us in another domain and still want the same ease of access they'd get if we were in the same domain) you can use the GrantUnityAccess tool to create "maps" of users in the domain they're loggin into over to the accounts Unity has to create in our domain for those users. Here's a post with more on that:
http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&type=bookmarks&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.ee88adf/0#selected_message
here's a link to the Unity documentation for 3.1 - the User Guide has a section in there on the use of the AA:
http://www.cisco.com/univercd/cc/td/doc/product/voice/c_unity/unity31/index.htm
The authentication model is the same for the AA as it is for the SA and the system administration guide covers that - it's in the same spot as above.
